DANE: When PKIX-EE matches don't clobber depth by trying PKIX-TA
[exim.git] / src / src / tls-openssl.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
3386088d 5/* Copyright (c) University of Cambridge 1995 - 2015 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
f5d78688
JH
8/* Portions Copyright (c) The OpenSSL Project 1999 */
9
059ec3d9
PH
10/* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
11library. It is #included into the tls.c file when that library is used. The
12code herein is based on a patch that was originally contributed by Steve
13Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
14
15No cryptographic code is included in Exim. All this module does is to call
16functions from the OpenSSL library. */
17
18
19/* Heading stuff */
20
21#include <openssl/lhash.h>
22#include <openssl/ssl.h>
23#include <openssl/err.h>
24#include <openssl/rand.h>
10ca4f1c
JH
25#ifndef OPENSSL_NO_ECDH
26# include <openssl/ec.h>
27#endif
f2de3a33 28#ifndef DISABLE_OCSP
e51c7be2 29# include <openssl/ocsp.h>
3f7eeb86 30#endif
85098ee7
JH
31#ifdef EXPERIMENTAL_DANE
32# include <danessl.h>
33#endif
34
3f7eeb86 35
f2de3a33
JH
36#ifndef DISABLE_OCSP
37# define EXIM_OCSP_SKEW_SECONDS (300L)
38# define EXIM_OCSP_MAX_AGE (-1L)
3f7eeb86 39#endif
059ec3d9 40
3bcbbbe2 41#if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
e51c7be2 42# define EXIM_HAVE_OPENSSL_TLSEXT
3bcbbbe2 43#endif
34e3241d
PP
44
45/*
46 * X509_check_host provides sane certificate hostname checking, but was added
47 * to OpenSSL late, after other projects forked off the code-base. So in
48 * addition to guarding against the base version number, beware that LibreSSL
49 * does not (at this time) support this function.
50 *
51 * If LibreSSL gains a different API, perhaps via libtls, then we'll probably
52 * opt to disentangle and ask a LibreSSL user to provide glue for a third
53 * crypto provider for libtls instead of continuing to tie the OpenSSL glue
54 * into even twistier knots. If LibreSSL gains the same API, we can just
55 * change this guard and punt the issue for a while longer.
56 */
57#ifndef LIBRESSL_VERSION_NUMBER
58# if OPENSSL_VERSION_NUMBER >= 0x010100000L
59# define EXIM_HAVE_OPENSSL_CHECKHOST
60# endif
61# if OPENSSL_VERSION_NUMBER >= 0x010000000L \
2dfb468b 62 && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
34e3241d
PP
63# define EXIM_HAVE_OPENSSL_CHECKHOST
64# endif
10ca4f1c
JH
65
66# if !defined(OPENSSL_NO_ECDH)
67# if OPENSSL_VERSION_NUMBER >= 0x0090800fL
68# define EXIM_HAVE_ECDH
69# endif
70# if OPENSSL_VERSION_NUMBER >= 0x10002000L
71# define EXIM_HAVE_OPENSSL_ECDH_AUTO
72# define EXIM_HAVE_OPENSSL_EC_NIST2NID
73# endif
74# endif
2dfb468b 75#endif
3bcbbbe2 76
67791ce4
JH
77#if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
78# warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
79# define DISABLE_OCSP
80#endif
81
059ec3d9
PH
82/* Structure for collecting random data for seeding. */
83
84typedef struct randstuff {
9e3331ea
TK
85 struct timeval tv;
86 pid_t p;
059ec3d9
PH
87} randstuff;
88
89/* Local static variables */
90
a2ff477a
JH
91static BOOL client_verify_callback_called = FALSE;
92static BOOL server_verify_callback_called = FALSE;
059ec3d9
PH
93static const uschar *sid_ctx = US"exim";
94
d4f09789
PP
95/* We have three different contexts to care about.
96
97Simple case: client, `client_ctx`
98 As a client, we can be doing a callout or cut-through delivery while receiving
99 a message. So we have a client context, which should have options initialised
100 from the SMTP Transport.
101
102Server:
103 There are two cases: with and without ServerNameIndication from the client.
104 Given TLS SNI, we can be using different keys, certs and various other
105 configuration settings, because they're re-expanded with $tls_sni set. This
106 allows vhosting with TLS. This SNI is sent in the handshake.
107 A client might not send SNI, so we need a fallback, and an initial setup too.
108 So as a server, we start out using `server_ctx`.
109 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
110 `server_sni` from `server_ctx` and then initialise settings by re-expanding
111 configuration.
112*/
113
817d9f57
JH
114static SSL_CTX *client_ctx = NULL;
115static SSL_CTX *server_ctx = NULL;
116static SSL *client_ssl = NULL;
117static SSL *server_ssl = NULL;
389ca47a 118
35731706 119#ifdef EXIM_HAVE_OPENSSL_TLSEXT
817d9f57 120static SSL_CTX *server_sni = NULL;
35731706 121#endif
059ec3d9
PH
122
123static char ssl_errstring[256];
124
125static int ssl_session_timeout = 200;
a2ff477a
JH
126static BOOL client_verify_optional = FALSE;
127static BOOL server_verify_optional = FALSE;
059ec3d9 128
f5d78688 129static BOOL reexpand_tls_files_for_sni = FALSE;
059ec3d9
PH
130
131
7be682ca
PP
132typedef struct tls_ext_ctx_cb {
133 uschar *certificate;
134 uschar *privatekey;
f2de3a33 135#ifndef DISABLE_OCSP
f5d78688
JH
136 BOOL is_server;
137 union {
138 struct {
139 uschar *file;
140 uschar *file_expanded;
141 OCSP_RESPONSE *response;
142 } server;
143 struct {
44662487
JH
144 X509_STORE *verify_store; /* non-null if status requested */
145 BOOL verify_required;
f5d78688
JH
146 } client;
147 } u_ocsp;
3f7eeb86 148#endif
7be682ca
PP
149 uschar *dhparam;
150 /* these are cached from first expand */
151 uschar *server_cipher_list;
152 /* only passed down to tls_error: */
153 host_item *host;
55414b25 154 const uschar * verify_cert_hostnames;
0cbf2b82 155#ifndef DISABLE_EVENT
a7538db1
JH
156 uschar * event_action;
157#endif
7be682ca
PP
158} tls_ext_ctx_cb;
159
160/* should figure out a cleanup of API to handle state preserved per
161implementation, for various reasons, which can be void * in the APIs.
162For now, we hack around it. */
817d9f57
JH
163tls_ext_ctx_cb *client_static_cbinfo = NULL;
164tls_ext_ctx_cb *server_static_cbinfo = NULL;
7be682ca
PP
165
166static int
983207c1
JH
167setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
168 int (*cert_vfy_cb)(int, X509_STORE_CTX *) );
059ec3d9 169
3f7eeb86 170/* Callbacks */
3bcbbbe2 171#ifdef EXIM_HAVE_OPENSSL_TLSEXT
3f7eeb86 172static int tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg);
3bcbbbe2 173#endif
f2de3a33 174#ifndef DISABLE_OCSP
f5d78688 175static int tls_server_stapling_cb(SSL *s, void *arg);
3f7eeb86
PP
176#endif
177
059ec3d9
PH
178
179/*************************************************
180* Handle TLS error *
181*************************************************/
182
183/* Called from lots of places when errors occur before actually starting to do
184the TLS handshake, that is, while the session is still in clear. Always returns
185DEFER for a server and FAIL for a client so that most calls can use "return
186tls_error(...)" to do this processing and then give an appropriate return. A
187single function is used for both server and client, because it is called from
188some shared functions.
189
190Argument:
191 prefix text to include in the logged error
192 host NULL if setting up a server;
193 the connected host if setting up a client
7199e1ee 194 msg error message or NULL if we should ask OpenSSL
059ec3d9
PH
195
196Returns: OK/DEFER/FAIL
197*/
198
199static int
b8b1b5cb 200tls_error(uschar * prefix, const host_item * host, uschar * msg)
059ec3d9 201{
c562fd30 202if (!msg)
7199e1ee
TF
203 {
204 ERR_error_string(ERR_get_error(), ssl_errstring);
5ca6d115 205 msg = (uschar *)ssl_errstring;
7199e1ee
TF
206 }
207
c562fd30
JH
208if (host)
209 {
210 log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection (%s): %s",
211 host->name, host->address, prefix, msg);
212 return FAIL;
213 }
214else
059ec3d9 215 {
7199e1ee 216 uschar *conn_info = smtp_get_connection_info();
5ca6d115 217 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
7199e1ee 218 conn_info += 5;
c562fd30 219 /* I'd like to get separated H= here, but too hard for now */
7199e1ee
TF
220 log_write(0, LOG_MAIN, "TLS error on %s (%s): %s",
221 conn_info, prefix, msg);
059ec3d9
PH
222 return DEFER;
223 }
059ec3d9
PH
224}
225
226
227
228/*************************************************
229* Callback to generate RSA key *
230*************************************************/
231
232/*
233Arguments:
234 s SSL connection
235 export not used
236 keylength keylength
237
238Returns: pointer to generated key
239*/
240
241static RSA *
242rsa_callback(SSL *s, int export, int keylength)
243{
244RSA *rsa_key;
245export = export; /* Shut picky compilers up */
246DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
247rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL);
248if (rsa_key == NULL)
249 {
250 ERR_error_string(ERR_get_error(), ssl_errstring);
251 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
252 ssl_errstring);
253 return NULL;
254 }
255return rsa_key;
256}
257
258
259
f5d78688 260/* Extreme debug
f2de3a33 261#ifndef DISABLE_OCSP
f5d78688
JH
262void
263x509_store_dump_cert_s_names(X509_STORE * store)
264{
265STACK_OF(X509_OBJECT) * roots= store->objs;
266int i;
267static uschar name[256];
268
269for(i= 0; i<sk_X509_OBJECT_num(roots); i++)
270 {
271 X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
272 if(tmp_obj->type == X509_LU_X509)
273 {
274 X509 * current_cert= tmp_obj->data.x509;
275 X509_NAME_oneline(X509_get_subject_name(current_cert), CS name, sizeof(name));
f69979cf 276 name[sizeof(name)-1] = '\0';
f5d78688
JH
277 debug_printf(" %s\n", name);
278 }
279 }
280}
281#endif
282*/
283
059ec3d9 284
0cbf2b82 285#ifndef DISABLE_EVENT
f69979cf
JH
286static int
287verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
288 BOOL *calledp, const BOOL *optionalp, const uschar * what)
289{
290uschar * ev;
291uschar * yield;
292X509 * old_cert;
293
294ev = tlsp == &tls_out ? client_static_cbinfo->event_action : event_action;
295if (ev)
296 {
aaba7d03 297 DEBUG(D_tls) debug_printf("verify_event: %s %d\n", what, depth);
f69979cf
JH
298 old_cert = tlsp->peercert;
299 tlsp->peercert = X509_dup(cert);
300 /* NB we do not bother setting peerdn */
301 if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth))))
302 {
303 log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
304 "depth=%d cert=%s: %s",
305 tlsp == &tls_out ? deliver_host_address : sender_host_address,
306 what, depth, dn, yield);
307 *calledp = TRUE;
308 if (!*optionalp)
309 {
310 if (old_cert) tlsp->peercert = old_cert; /* restore 1st failing cert */
311 return 1; /* reject (leaving peercert set) */
312 }
313 DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
314 "(host in tls_try_verify_hosts)\n");
315 }
316 X509_free(tlsp->peercert);
317 tlsp->peercert = old_cert;
318 }
319return 0;
320}
321#endif
322
059ec3d9
PH
323/*************************************************
324* Callback for verification *
325*************************************************/
326
327/* The SSL library does certificate verification if set up to do so. This
328callback has the current yes/no state is in "state". If verification succeeded,
f69979cf
JH
329we set the certificate-verified flag. If verification failed, what happens
330depends on whether the client is required to present a verifiable certificate
331or not.
059ec3d9
PH
332
333If verification is optional, we change the state to yes, but still log the
334verification error. For some reason (it really would help to have proper
335documentation of OpenSSL), this callback function then gets called again, this
f69979cf
JH
336time with state = 1. We must take care not to set the private verified flag on
337the second time through.
059ec3d9
PH
338
339Note: this function is not called if the client fails to present a certificate
340when asked. We get here only if a certificate has been received. Handling of
341optional verification for this case is done when requesting SSL to verify, by
342setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
343
a7538db1
JH
344May be called multiple times for different issues with a certificate, even
345for a given "depth" in the certificate chain.
346
059ec3d9
PH
347Arguments:
348 state current yes/no state as 1/0
349 x509ctx certificate information.
a2ff477a 350 client TRUE for client startup, FALSE for server startup
059ec3d9
PH
351
352Returns: 1 if verified, 0 if not
353*/
354
355static int
421aff85
JH
356verify_callback(int state, X509_STORE_CTX *x509ctx,
357 tls_support *tlsp, BOOL *calledp, BOOL *optionalp)
059ec3d9 358{
421aff85 359X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
a7538db1 360int depth = X509_STORE_CTX_get_error_depth(x509ctx);
f69979cf 361uschar dn[256];
059ec3d9 362
f69979cf
JH
363X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn));
364dn[sizeof(dn)-1] = '\0';
059ec3d9
PH
365
366if (state == 0)
367 {
4c01d6ab
JH
368 log_write(0, LOG_MAIN, "[%s] SSL verify error: depth=%d error=%s cert=%s",
369 tlsp == &tls_out ? deliver_host_address : sender_host_address,
a7538db1 370 depth,
421aff85 371 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)),
f69979cf 372 dn);
a2ff477a 373 *calledp = TRUE;
9d1c15ef
JH
374 if (!*optionalp)
375 {
f69979cf
JH
376 if (!tlsp->peercert)
377 tlsp->peercert = X509_dup(cert); /* record failing cert */
378 return 0; /* reject */
9d1c15ef 379 }
059ec3d9
PH
380 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
381 "tls_try_verify_hosts)\n");
059ec3d9
PH
382 }
383
a7538db1 384else if (depth != 0)
059ec3d9 385 {
f69979cf 386 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);
f2de3a33 387#ifndef DISABLE_OCSP
f5d78688
JH
388 if (tlsp == &tls_out && client_static_cbinfo->u_ocsp.client.verify_store)
389 { /* client, wanting stapling */
390 /* Add the server cert's signing chain as the one
391 for the verification of the OCSP stapled information. */
94431adb 392
f5d78688 393 if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
421aff85 394 cert))
f5d78688
JH
395 ERR_clear_error();
396 }
397#endif
0cbf2b82 398#ifndef DISABLE_EVENT
f69979cf
JH
399 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
400 return 0; /* reject, with peercert set */
a7538db1 401#endif
059ec3d9
PH
402 }
403else
404 {
55414b25 405 const uschar * verify_cert_hostnames;
e51c7be2 406
e51c7be2
JH
407 if ( tlsp == &tls_out
408 && ((verify_cert_hostnames = client_static_cbinfo->verify_cert_hostnames)))
409 /* client, wanting hostname check */
e51c7be2 410 {
f69979cf 411
740f36d4 412#ifdef EXIM_HAVE_OPENSSL_CHECKHOST
f69979cf
JH
413# ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
414# define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
415# endif
416# ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
417# define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
418# endif
e51c7be2 419 int sep = 0;
55414b25 420 const uschar * list = verify_cert_hostnames;
e51c7be2 421 uschar * name;
d8e7834a
JH
422 int rc;
423 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
424 if ((rc = X509_check_host(cert, name, 0,
8d692470 425 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
740f36d4
JH
426 | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS,
427 NULL)))
d8e7834a
JH
428 {
429 if (rc < 0)
430 {
93a6fce2 431 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
4c01d6ab 432 tlsp == &tls_out ? deliver_host_address : sender_host_address);
d8e7834a
JH
433 name = NULL;
434 }
e51c7be2 435 break;
d8e7834a 436 }
e51c7be2 437 if (!name)
f69979cf 438#else
e51c7be2 439 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
f69979cf 440#endif
e51c7be2
JH
441 {
442 log_write(0, LOG_MAIN,
93a6fce2 443 "[%s] SSL verify error: certificate name mismatch: \"%s\"",
4c01d6ab 444 tlsp == &tls_out ? deliver_host_address : sender_host_address,
f69979cf 445 dn);
a3ef7310
JH
446 *calledp = TRUE;
447 if (!*optionalp)
f69979cf
JH
448 {
449 if (!tlsp->peercert)
450 tlsp->peercert = X509_dup(cert); /* record failing cert */
451 return 0; /* reject */
452 }
a3ef7310
JH
453 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
454 "tls_try_verify_hosts)\n");
e51c7be2 455 }
f69979cf 456 }
e51c7be2 457
0cbf2b82 458#ifndef DISABLE_EVENT
f69979cf
JH
459 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
460 return 0; /* reject, with peercert set */
e51c7be2
JH
461#endif
462
93dcb1c2 463 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
f69979cf 464 *calledp ? "" : " authenticated", dn);
93dcb1c2
JH
465 if (!*calledp) tlsp->certificate_verified = TRUE;
466 *calledp = TRUE;
059ec3d9
PH
467 }
468
a7538db1 469return 1; /* accept, at least for this level */
059ec3d9
PH
470}
471
a2ff477a
JH
472static int
473verify_callback_client(int state, X509_STORE_CTX *x509ctx)
474{
f5d78688 475return verify_callback(state, x509ctx, &tls_out, &client_verify_callback_called, &client_verify_optional);
a2ff477a
JH
476}
477
478static int
479verify_callback_server(int state, X509_STORE_CTX *x509ctx)
480{
f5d78688 481return verify_callback(state, x509ctx, &tls_in, &server_verify_callback_called, &server_verify_optional);
a2ff477a
JH
482}
483
059ec3d9 484
e5cccda9 485#ifdef EXPERIMENTAL_DANE
53a7196b 486
e5cccda9
JH
487/* This gets called *by* the dane library verify callback, which interposes
488itself.
489*/
490static int
491verify_callback_client_dane(int state, X509_STORE_CTX * x509ctx)
492{
493X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
f69979cf 494uschar dn[256];
0cbf2b82 495#ifndef DISABLE_EVENT
83b27293 496int depth = X509_STORE_CTX_get_error_depth(x509ctx);
f69979cf 497BOOL dummy_called, optional = FALSE;
83b27293 498#endif
e5cccda9 499
f69979cf
JH
500X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn));
501dn[sizeof(dn)-1] = '\0';
e5cccda9 502
f69979cf 503DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s\n", dn);
e5cccda9 504
0cbf2b82 505#ifndef DISABLE_EVENT
f69979cf
JH
506 if (verify_event(&tls_out, cert, depth, dn,
507 &dummy_called, &optional, US"DANE"))
508 return 0; /* reject, with peercert set */
83b27293
JH
509#endif
510
e5cccda9 511if (state == 1)
53a7196b 512 tls_out.dane_verified =
e5cccda9
JH
513 tls_out.certificate_verified = TRUE;
514return 1;
515}
53a7196b
JH
516
517#endif /*EXPERIMENTAL_DANE*/
e5cccda9 518
059ec3d9
PH
519
520/*************************************************
521* Information callback *
522*************************************************/
523
524/* The SSL library functions call this from time to time to indicate what they
7be682ca
PP
525are doing. We copy the string to the debugging output when TLS debugging has
526been requested.
059ec3d9
PH
527
528Arguments:
529 s the SSL connection
530 where
531 ret
532
533Returns: nothing
534*/
535
536static void
537info_callback(SSL *s, int where, int ret)
538{
539where = where;
540ret = ret;
541DEBUG(D_tls) debug_printf("SSL info: %s\n", SSL_state_string_long(s));
542}
543
544
545
546/*************************************************
547* Initialize for DH *
548*************************************************/
549
550/* If dhparam is set, expand it, and load up the parameters for DH encryption.
551
552Arguments:
038597d2 553 sctx The current SSL CTX (inbound or outbound)
a799883d 554 dhparam DH parameter file or fixed parameter identity string
7199e1ee 555 host connected host, if client; NULL if server
059ec3d9
PH
556
557Returns: TRUE if OK (nothing to set up, or setup worked)
558*/
559
560static BOOL
b8b1b5cb 561init_dh(SSL_CTX *sctx, uschar *dhparam, const host_item *host)
059ec3d9 562{
059ec3d9
PH
563BIO *bio;
564DH *dh;
565uschar *dhexpanded;
a799883d 566const char *pem;
059ec3d9
PH
567
568if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded))
569 return FALSE;
570
0df4ab80 571if (!dhexpanded || !*dhexpanded)
a799883d 572 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
a799883d 573else if (dhexpanded[0] == '/')
059ec3d9 574 {
0df4ab80 575 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
059ec3d9 576 {
7199e1ee 577 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
a799883d
PP
578 host, US strerror(errno));
579 return FALSE;
059ec3d9 580 }
a799883d
PP
581 }
582else
583 {
584 if (Ustrcmp(dhexpanded, "none") == 0)
059ec3d9 585 {
a799883d
PP
586 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
587 return TRUE;
059ec3d9 588 }
a799883d 589
0df4ab80 590 if (!(pem = std_dh_prime_named(dhexpanded)))
a799883d
PP
591 {
592 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
593 host, US strerror(errno));
594 return FALSE;
595 }
596 bio = BIO_new_mem_buf(CS pem, -1);
597 }
598
0df4ab80 599if (!(dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)))
a799883d 600 {
059ec3d9 601 BIO_free(bio);
a799883d
PP
602 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
603 host, NULL);
604 return FALSE;
605 }
606
607/* Even if it is larger, we silently return success rather than cause things
608 * to fail out, so that a too-large DH will not knock out all TLS; it's a
609 * debatable choice. */
610if ((8*DH_size(dh)) > tls_dh_max_bits)
611 {
612 DEBUG(D_tls)
613 debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d",
614 8*DH_size(dh), tls_dh_max_bits);
615 }
616else
617 {
618 SSL_CTX_set_tmp_dh(sctx, dh);
619 DEBUG(D_tls)
620 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
621 dhexpanded ? dhexpanded : US"default", 8*DH_size(dh));
059ec3d9
PH
622 }
623
a799883d
PP
624DH_free(dh);
625BIO_free(bio);
626
627return TRUE;
059ec3d9
PH
628}
629
630
631
632
038597d2
PP
633/*************************************************
634* Initialize for ECDH *
635*************************************************/
636
637/* Load parameters for ECDH encryption.
638
639For now, we stick to NIST P-256 because: it's simple and easy to configure;
640it avoids any patent issues that might bite redistributors; despite events in
641the news and concerns over curve choices, we're not cryptographers, we're not
642pretending to be, and this is "good enough" to be better than no support,
643protecting against most adversaries. Given another year or two, there might
644be sufficient clarity about a "right" way forward to let us make an informed
645decision, instead of a knee-jerk reaction.
646
647Longer-term, we should look at supporting both various named curves and
648external files generated with "openssl ecparam", much as we do for init_dh().
649We should also support "none" as a value, to explicitly avoid initialisation.
650
651Patches welcome.
652
653Arguments:
654 sctx The current SSL CTX (inbound or outbound)
655 host connected host, if client; NULL if server
656
657Returns: TRUE if OK (nothing to set up, or setup worked)
658*/
659
660static BOOL
10ca4f1c 661init_ecdh(SSL_CTX * sctx, host_item * host)
038597d2 662{
63f0dbe0
JH
663#ifdef OPENSSL_NO_ECDH
664return TRUE;
665#else
666
10ca4f1c
JH
667EC_KEY * ecdh;
668uschar * exp_curve;
669int nid;
670BOOL rv;
671
038597d2
PP
672if (host) /* No ECDH setup for clients, only for servers */
673 return TRUE;
674
10ca4f1c 675# ifndef EXIM_HAVE_ECDH
038597d2
PP
676DEBUG(D_tls)
677 debug_printf("No OpenSSL API to define ECDH parameters, skipping\n");
678return TRUE;
038597d2 679# else
10ca4f1c
JH
680
681if (!expand_check(tls_eccurve, US"tls_eccurve", &exp_curve))
682 return FALSE;
683if (!exp_curve || !*exp_curve)
684 return TRUE;
685
686# ifdef EXIM_HAVE_OPENSSL_ECDH_AUTO
687/* check if new enough library to support auto ECDH temp key parameter selection */
688if (Ustrcmp(exp_curve, "auto") == 0)
038597d2 689 {
10ca4f1c
JH
690 DEBUG(D_tls) debug_printf(
691 "ECDH temp key parameter settings: OpenSSL 1.2+ autoselection\n");
692 SSL_CTX_set_ecdh_auto(sctx, 1);
693 return TRUE;
694 }
695# endif
038597d2 696
10ca4f1c
JH
697DEBUG(D_tls) debug_printf("ECDH: curve '%s'\n", exp_curve);
698if ( (nid = OBJ_sn2nid (CCS exp_curve)) == NID_undef
699# ifdef EXIM_HAVE_OPENSSL_EC_NIST2NID
700 && (nid = EC_curve_nist2nid(CCS exp_curve)) == NID_undef
701# endif
702 )
703 {
704 tls_error(string_sprintf("Unknown curve name tls_eccurve '%s'",
705 exp_curve),
706 host, NULL);
707 return FALSE;
708 }
038597d2 709
10ca4f1c
JH
710if (!(ecdh = EC_KEY_new_by_curve_name(nid)))
711 {
aa7751be 712 tls_error(US"Unable to create ec curve", host, NULL);
10ca4f1c 713 return FALSE;
038597d2 714 }
10ca4f1c
JH
715
716/* The "tmp" in the name here refers to setting a temporary key
717not to the stability of the interface. */
718
719if ((rv = SSL_CTX_set_tmp_ecdh(sctx, ecdh) == 0))
720 tls_error(string_sprintf("Error enabling '%s' curve", exp_curve), host, NULL);
721else
722 DEBUG(D_tls) debug_printf("ECDH: enabled '%s' curve\n", exp_curve);
723
724EC_KEY_free(ecdh);
725return !rv;
726
727# endif /*EXIM_HAVE_ECDH*/
728#endif /*OPENSSL_NO_ECDH*/
038597d2
PP
729}
730
731
732
733
f2de3a33 734#ifndef DISABLE_OCSP
3f7eeb86
PP
735/*************************************************
736* Load OCSP information into state *
737*************************************************/
738
f5d78688 739/* Called to load the server OCSP response from the given file into memory, once
3f7eeb86
PP
740caller has determined this is needed. Checks validity. Debugs a message
741if invalid.
742
743ASSUMES: single response, for single cert.
744
745Arguments:
746 sctx the SSL_CTX* to update
747 cbinfo various parts of session state
748 expanded the filename putatively holding an OCSP response
749
750*/
751
752static void
f5d78688 753ocsp_load_response(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo, const uschar *expanded)
3f7eeb86
PP
754{
755BIO *bio;
756OCSP_RESPONSE *resp;
757OCSP_BASICRESP *basic_response;
758OCSP_SINGLERESP *single_response;
759ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
760X509_STORE *store;
761unsigned long verify_flags;
762int status, reason, i;
763
f5d78688
JH
764cbinfo->u_ocsp.server.file_expanded = string_copy(expanded);
765if (cbinfo->u_ocsp.server.response)
3f7eeb86 766 {
f5d78688
JH
767 OCSP_RESPONSE_free(cbinfo->u_ocsp.server.response);
768 cbinfo->u_ocsp.server.response = NULL;
3f7eeb86
PP
769 }
770
f5d78688 771bio = BIO_new_file(CS cbinfo->u_ocsp.server.file_expanded, "rb");
3f7eeb86
PP
772if (!bio)
773 {
774 DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
f5d78688 775 cbinfo->u_ocsp.server.file_expanded);
3f7eeb86
PP
776 return;
777 }
778
779resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
780BIO_free(bio);
781if (!resp)
782 {
783 DEBUG(D_tls) debug_printf("Error reading OCSP response.\n");
784 return;
785 }
786
787status = OCSP_response_status(resp);
788if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL)
789 {
790 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
791 OCSP_response_status_str(status), status);
f5d78688 792 goto bad;
3f7eeb86
PP
793 }
794
795basic_response = OCSP_response_get1_basic(resp);
796if (!basic_response)
797 {
798 DEBUG(D_tls)
799 debug_printf("OCSP response parse error: unable to extract basic response.\n");
f5d78688 800 goto bad;
3f7eeb86
PP
801 }
802
803store = SSL_CTX_get_cert_store(sctx);
804verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
805
806/* May need to expose ability to adjust those flags?
807OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
808OCSP_TRUSTOTHER OCSP_NOINTERN */
809
810i = OCSP_basic_verify(basic_response, NULL, store, verify_flags);
811if (i <= 0)
812 {
813 DEBUG(D_tls) {
814 ERR_error_string(ERR_get_error(), ssl_errstring);
815 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
f5d78688
JH
816 }
817 goto bad;
3f7eeb86
PP
818 }
819
820/* Here's the simplifying assumption: there's only one response, for the
821one certificate we use, and nothing for anything else in a chain. If this
822proves false, we need to extract a cert id from our issued cert
823(tls_certificate) and use that for OCSP_resp_find_status() (which finds the
824right cert in the stack and then calls OCSP_single_get0_status()).
825
826I'm hoping to avoid reworking a bunch more of how we handle state here. */
827single_response = OCSP_resp_get0(basic_response, 0);
828if (!single_response)
829 {
830 DEBUG(D_tls)
831 debug_printf("Unable to get first response from OCSP basic response.\n");
f5d78688 832 goto bad;
3f7eeb86
PP
833 }
834
835status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
f5d78688 836if (status != V_OCSP_CERTSTATUS_GOOD)
3f7eeb86 837 {
f5d78688
JH
838 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
839 OCSP_cert_status_str(status), status,
840 OCSP_crl_reason_str(reason), reason);
841 goto bad;
3f7eeb86
PP
842 }
843
844if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
845 {
846 DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
f5d78688 847 goto bad;
3f7eeb86
PP
848 }
849
f5d78688 850supply_response:
018058b2 851 cbinfo->u_ocsp.server.response = resp;
f5d78688
JH
852return;
853
854bad:
018058b2
JH
855 if (running_in_test_harness)
856 {
857 extern char ** environ;
858 uschar ** p;
859 for (p = USS environ; *p != NULL; p++)
860 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
861 {
862 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
863 goto supply_response;
864 }
865 }
f5d78688 866return;
3f7eeb86 867}
f2de3a33 868#endif /*!DISABLE_OCSP*/
3f7eeb86
PP
869
870
871
872
059ec3d9 873/*************************************************
7be682ca
PP
874* Expand key and cert file specs *
875*************************************************/
876
f5d78688 877/* Called once during tls_init and possibly again during TLS setup, for a
7be682ca
PP
878new context, if Server Name Indication was used and tls_sni was seen in
879the certificate string.
880
881Arguments:
882 sctx the SSL_CTX* to update
883 cbinfo various parts of session state
884
885Returns: OK/DEFER/FAIL
886*/
887
888static int
3f7eeb86 889tls_expand_session_files(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo)
7be682ca
PP
890{
891uschar *expanded;
892
893if (cbinfo->certificate == NULL)
894 return OK;
895
d9b2312b
JH
896if (Ustrstr(cbinfo->certificate, US"tls_sni") ||
897 Ustrstr(cbinfo->certificate, US"tls_in_sni") ||
898 Ustrstr(cbinfo->certificate, US"tls_out_sni")
899 )
7be682ca
PP
900 reexpand_tls_files_for_sni = TRUE;
901
902if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded))
903 return DEFER;
904
905if (expanded != NULL)
906 {
907 DEBUG(D_tls) debug_printf("tls_certificate file %s\n", expanded);
908 if (!SSL_CTX_use_certificate_chain_file(sctx, CS expanded))
909 return tls_error(string_sprintf(
910 "SSL_CTX_use_certificate_chain_file file=%s", expanded),
911 cbinfo->host, NULL);
912 }
913
914if (cbinfo->privatekey != NULL &&
915 !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded))
916 return DEFER;
917
918/* If expansion was forced to fail, key_expanded will be NULL. If the result
919of the expansion is an empty string, ignore it also, and assume the private
920key is in the same file as the certificate. */
921
922if (expanded != NULL && *expanded != 0)
923 {
924 DEBUG(D_tls) debug_printf("tls_privatekey file %s\n", expanded);
925 if (!SSL_CTX_use_PrivateKey_file(sctx, CS expanded, SSL_FILETYPE_PEM))
926 return tls_error(string_sprintf(
927 "SSL_CTX_use_PrivateKey_file file=%s", expanded), cbinfo->host, NULL);
928 }
929
f2de3a33 930#ifndef DISABLE_OCSP
f5d78688 931if (cbinfo->is_server && cbinfo->u_ocsp.server.file != NULL)
3f7eeb86 932 {
f5d78688 933 if (!expand_check(cbinfo->u_ocsp.server.file, US"tls_ocsp_file", &expanded))
3f7eeb86
PP
934 return DEFER;
935
936 if (expanded != NULL && *expanded != 0)
937 {
938 DEBUG(D_tls) debug_printf("tls_ocsp_file %s\n", expanded);
f5d78688
JH
939 if (cbinfo->u_ocsp.server.file_expanded &&
940 (Ustrcmp(expanded, cbinfo->u_ocsp.server.file_expanded) == 0))
3f7eeb86
PP
941 {
942 DEBUG(D_tls)
943 debug_printf("tls_ocsp_file value unchanged, using existing values.\n");
944 } else {
945 ocsp_load_response(sctx, cbinfo, expanded);
946 }
947 }
948 }
949#endif
950
7be682ca
PP
951return OK;
952}
953
954
955
956
957/*************************************************
958* Callback to handle SNI *
959*************************************************/
960
961/* Called when acting as server during the TLS session setup if a Server Name
962Indication extension was sent by the client.
963
964API documentation is OpenSSL s_server.c implementation.
965
966Arguments:
967 s SSL* of the current session
968 ad unknown (part of OpenSSL API) (unused)
969 arg Callback of "our" registered data
970
971Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
972*/
973
3bcbbbe2 974#ifdef EXIM_HAVE_OPENSSL_TLSEXT
7be682ca 975static int
7be682ca
PP
976tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
977{
978const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
3f7eeb86 979tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
7be682ca 980int rc;
3f0945ff 981int old_pool = store_pool;
7be682ca
PP
982
983if (!servername)
984 return SSL_TLSEXT_ERR_OK;
985
3f0945ff 986DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
7be682ca
PP
987 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
988
989/* Make the extension value available for expansion */
3f0945ff 990store_pool = POOL_PERM;
817d9f57 991tls_in.sni = string_copy(US servername);
3f0945ff 992store_pool = old_pool;
7be682ca
PP
993
994if (!reexpand_tls_files_for_sni)
995 return SSL_TLSEXT_ERR_OK;
996
997/* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
998not confident that memcpy wouldn't break some internal reference counting.
999Especially since there's a references struct member, which would be off. */
1000
0df4ab80 1001if (!(server_sni = SSL_CTX_new(SSLv23_server_method())))
7be682ca
PP
1002 {
1003 ERR_error_string(ERR_get_error(), ssl_errstring);
1004 DEBUG(D_tls) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring);
1005 return SSL_TLSEXT_ERR_NOACK;
1006 }
1007
1008/* Not sure how many of these are actually needed, since SSL object
1009already exists. Might even need this selfsame callback, for reneg? */
1010
817d9f57
JH
1011SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(server_ctx));
1012SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(server_ctx));
1013SSL_CTX_set_options(server_sni, SSL_CTX_get_options(server_ctx));
1014SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(server_ctx));
1015SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
1016SSL_CTX_set_tlsext_servername_arg(server_sni, cbinfo);
038597d2
PP
1017
1018if ( !init_dh(server_sni, cbinfo->dhparam, NULL)
1019 || !init_ecdh(server_sni, NULL)
1020 )
1021 return SSL_TLSEXT_ERR_NOACK;
1022
7be682ca 1023if (cbinfo->server_cipher_list)
817d9f57 1024 SSL_CTX_set_cipher_list(server_sni, CS cbinfo->server_cipher_list);
f2de3a33 1025#ifndef DISABLE_OCSP
f5d78688 1026if (cbinfo->u_ocsp.server.file)
3f7eeb86 1027 {
f5d78688 1028 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
14c7b357 1029 SSL_CTX_set_tlsext_status_arg(server_sni, cbinfo);
3f7eeb86
PP
1030 }
1031#endif
7be682ca 1032
983207c1 1033rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE, verify_callback_server);
7be682ca
PP
1034if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
1035
3f7eeb86
PP
1036/* do this after setup_certs, because this can require the certs for verifying
1037OCSP information. */
038597d2 1038if ((rc = tls_expand_session_files(server_sni, cbinfo)) != OK)
0df4ab80 1039 return SSL_TLSEXT_ERR_NOACK;
a799883d 1040
7be682ca 1041DEBUG(D_tls) debug_printf("Switching SSL context.\n");
817d9f57 1042SSL_set_SSL_CTX(s, server_sni);
7be682ca
PP
1043
1044return SSL_TLSEXT_ERR_OK;
1045}
3bcbbbe2 1046#endif /* EXIM_HAVE_OPENSSL_TLSEXT */
7be682ca
PP
1047
1048
1049
1050
f2de3a33 1051#ifndef DISABLE_OCSP
f5d78688 1052
3f7eeb86
PP
1053/*************************************************
1054* Callback to handle OCSP Stapling *
1055*************************************************/
1056
1057/* Called when acting as server during the TLS session setup if the client
1058requests OCSP information with a Certificate Status Request.
1059
1060Documentation via openssl s_server.c and the Apache patch from the OpenSSL
1061project.
1062
1063*/
1064
1065static int
f5d78688 1066tls_server_stapling_cb(SSL *s, void *arg)
3f7eeb86
PP
1067{
1068const tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
1069uschar *response_der;
1070int response_der_len;
1071
af4a1bca 1072DEBUG(D_tls)
b3ef41c9 1073 debug_printf("Received TLS status request (OCSP stapling); %s response\n",
f5d78688
JH
1074 cbinfo->u_ocsp.server.response ? "have" : "lack");
1075
44662487 1076tls_in.ocsp = OCSP_NOT_RESP;
f5d78688 1077if (!cbinfo->u_ocsp.server.response)
3f7eeb86
PP
1078 return SSL_TLSEXT_ERR_NOACK;
1079
1080response_der = NULL;
44662487
JH
1081response_der_len = i2d_OCSP_RESPONSE(cbinfo->u_ocsp.server.response,
1082 &response_der);
3f7eeb86
PP
1083if (response_der_len <= 0)
1084 return SSL_TLSEXT_ERR_NOACK;
1085
5e55c7a9 1086SSL_set_tlsext_status_ocsp_resp(server_ssl, response_der, response_der_len);
44662487 1087tls_in.ocsp = OCSP_VFIED;
3f7eeb86
PP
1088return SSL_TLSEXT_ERR_OK;
1089}
1090
3f7eeb86 1091
f5d78688
JH
1092static void
1093time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
1094{
1095BIO_printf(bp, "\t%s: ", str);
1096ASN1_GENERALIZEDTIME_print(bp, time);
1097BIO_puts(bp, "\n");
1098}
1099
1100static int
1101tls_client_stapling_cb(SSL *s, void *arg)
1102{
1103tls_ext_ctx_cb * cbinfo = arg;
1104const unsigned char * p;
1105int len;
1106OCSP_RESPONSE * rsp;
1107OCSP_BASICRESP * bs;
1108int i;
1109
1110DEBUG(D_tls) debug_printf("Received TLS status response (OCSP stapling):");
1111len = SSL_get_tlsext_status_ocsp_resp(s, &p);
1112if(!p)
1113 {
44662487 1114 /* Expect this when we requested ocsp but got none */
6c6d6e48 1115 if (cbinfo->u_ocsp.client.verify_required && LOGGING(tls_cipher))
44662487 1116 log_write(0, LOG_MAIN, "Received TLS status callback, null content");
f5d78688
JH
1117 else
1118 DEBUG(D_tls) debug_printf(" null\n");
44662487 1119 return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
f5d78688 1120 }
018058b2 1121
f5d78688
JH
1122if(!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
1123 {
018058b2 1124 tls_out.ocsp = OCSP_FAILED;
6c6d6e48 1125 if (LOGGING(tls_cipher))
1eca31ca 1126 log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
f5d78688
JH
1127 else
1128 DEBUG(D_tls) debug_printf(" parse error\n");
1129 return 0;
1130 }
1131
1132if(!(bs = OCSP_response_get1_basic(rsp)))
1133 {
018058b2 1134 tls_out.ocsp = OCSP_FAILED;
6c6d6e48 1135 if (LOGGING(tls_cipher))
1eca31ca 1136 log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
f5d78688
JH
1137 else
1138 DEBUG(D_tls) debug_printf(" error parsing response\n");
1139 OCSP_RESPONSE_free(rsp);
1140 return 0;
1141 }
1142
1143/* We'd check the nonce here if we'd put one in the request. */
1144/* However that would defeat cacheability on the server so we don't. */
1145
f5d78688
JH
1146/* This section of code reworked from OpenSSL apps source;
1147 The OpenSSL Project retains copyright:
1148 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
1149*/
1150 {
1151 BIO * bp = NULL;
f5d78688
JH
1152 int status, reason;
1153 ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
1154
1155 DEBUG(D_tls) bp = BIO_new_fp(stderr, BIO_NOCLOSE);
1156
1157 /*OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
1158
1159 /* Use the chain that verified the server cert to verify the stapled info */
1160 /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
1161
44662487
JH
1162 if ((i = OCSP_basic_verify(bs, NULL,
1163 cbinfo->u_ocsp.client.verify_store, 0)) <= 0)
f5d78688 1164 {
018058b2 1165 tls_out.ocsp = OCSP_FAILED;
6c6d6e48 1166 if (LOGGING(tls_cipher))
1eca31ca 1167 log_write(0, LOG_MAIN, "Received TLS cert status response, itself unverifiable");
f5d78688
JH
1168 BIO_printf(bp, "OCSP response verify failure\n");
1169 ERR_print_errors(bp);
44662487 1170 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
f5d78688
JH
1171 goto out;
1172 }
1173
1174 BIO_printf(bp, "OCSP response well-formed and signed OK\n");
1175
1176 {
1177 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
1178 OCSP_SINGLERESP * single;
1179
1180 if (sk_OCSP_SINGLERESP_num(sresp) != 1)
1181 {
018058b2 1182 tls_out.ocsp = OCSP_FAILED;
44662487
JH
1183 log_write(0, LOG_MAIN, "OCSP stapling "
1184 "with multiple responses not handled");
1185 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
f5d78688
JH
1186 goto out;
1187 }
1188 single = OCSP_resp_get0(bs, 0);
44662487
JH
1189 status = OCSP_single_get0_status(single, &reason, &rev,
1190 &thisupd, &nextupd);
f5d78688
JH
1191 }
1192
f5d78688
JH
1193 DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
1194 DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
44662487
JH
1195 if (!OCSP_check_validity(thisupd, nextupd,
1196 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
f5d78688 1197 {
018058b2 1198 tls_out.ocsp = OCSP_FAILED;
f5d78688
JH
1199 DEBUG(D_tls) ERR_print_errors(bp);
1200 log_write(0, LOG_MAIN, "Server OSCP dates invalid");
44662487 1201 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
f5d78688 1202 }
44662487 1203 else
f5d78688 1204 {
44662487
JH
1205 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
1206 OCSP_cert_status_str(status));
1207 switch(status)
1208 {
1209 case V_OCSP_CERTSTATUS_GOOD:
44662487 1210 tls_out.ocsp = OCSP_VFIED;
018058b2 1211 i = 1;
44662487
JH
1212 break;
1213 case V_OCSP_CERTSTATUS_REVOKED:
018058b2 1214 tls_out.ocsp = OCSP_FAILED;
44662487
JH
1215 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
1216 reason != -1 ? "; reason: " : "",
1217 reason != -1 ? OCSP_crl_reason_str(reason) : "");
1218 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
1219 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1220 break;
1221 default:
018058b2 1222 tls_out.ocsp = OCSP_FAILED;
44662487
JH
1223 log_write(0, LOG_MAIN,
1224 "Server certificate status unknown, in OCSP stapling");
1225 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1226 break;
1227 }
f5d78688
JH
1228 }
1229 out:
1230 BIO_free(bp);
1231 }
1232
1233OCSP_RESPONSE_free(rsp);
1234return i;
1235}
f2de3a33 1236#endif /*!DISABLE_OCSP*/
3f7eeb86
PP
1237
1238
7be682ca 1239/*************************************************
059ec3d9
PH
1240* Initialize for TLS *
1241*************************************************/
1242
e51c7be2
JH
1243/* Called from both server and client code, to do preliminary initialization
1244of the library. We allocate and return a context structure.
059ec3d9
PH
1245
1246Arguments:
946ecbe0 1247 ctxp returned SSL context
059ec3d9
PH
1248 host connected host, if client; NULL if server
1249 dhparam DH parameter file
1250 certificate certificate file
1251 privatekey private key
f5d78688 1252 ocsp_file file of stapling info (server); flag for require ocsp (client)
059ec3d9 1253 addr address if client; NULL if server (for some randomness)
946ecbe0 1254 cbp place to put allocated callback context
059ec3d9
PH
1255
1256Returns: OK/DEFER/FAIL
1257*/
1258
1259static int
817d9f57 1260tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate,
3f7eeb86 1261 uschar *privatekey,
f2de3a33 1262#ifndef DISABLE_OCSP
3f7eeb86
PP
1263 uschar *ocsp_file,
1264#endif
817d9f57 1265 address_item *addr, tls_ext_ctx_cb ** cbp)
059ec3d9 1266{
77bb000f 1267long init_options;
7be682ca 1268int rc;
77bb000f 1269BOOL okay;
a7538db1 1270tls_ext_ctx_cb * cbinfo;
7be682ca
PP
1271
1272cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
1273cbinfo->certificate = certificate;
1274cbinfo->privatekey = privatekey;
f2de3a33 1275#ifndef DISABLE_OCSP
f5d78688
JH
1276if ((cbinfo->is_server = host==NULL))
1277 {
1278 cbinfo->u_ocsp.server.file = ocsp_file;
1279 cbinfo->u_ocsp.server.file_expanded = NULL;
1280 cbinfo->u_ocsp.server.response = NULL;
1281 }
1282else
1283 cbinfo->u_ocsp.client.verify_store = NULL;
3f7eeb86 1284#endif
7be682ca 1285cbinfo->dhparam = dhparam;
0df4ab80 1286cbinfo->server_cipher_list = NULL;
7be682ca 1287cbinfo->host = host;
0cbf2b82 1288#ifndef DISABLE_EVENT
a7538db1
JH
1289cbinfo->event_action = NULL;
1290#endif
77bb000f 1291
059ec3d9
PH
1292SSL_load_error_strings(); /* basic set up */
1293OpenSSL_add_ssl_algorithms();
1294
388d6564 1295#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
77bb000f 1296/* SHA256 is becoming ever more popular. This makes sure it gets added to the
a0475b69
TK
1297list of available digests. */
1298EVP_add_digest(EVP_sha256());
cf1ef1a9 1299#endif
a0475b69 1300
f0f5a555
PP
1301/* Create a context.
1302The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
1303negotiation in the different methods; as far as I can tell, the only
1304*_{server,client}_method which allows negotiation is SSLv23, which exists even
1305when OpenSSL is built without SSLv2 support.
1306By disabling with openssl_options, we can let admins re-enable with the
1307existing knob. */
059ec3d9 1308
817d9f57 1309*ctxp = SSL_CTX_new((host == NULL)?
059ec3d9
PH
1310 SSLv23_server_method() : SSLv23_client_method());
1311
817d9f57 1312if (*ctxp == NULL) return tls_error(US"SSL_CTX_new", host, NULL);
059ec3d9
PH
1313
1314/* It turns out that we need to seed the random number generator this early in
1315order to get the full complement of ciphers to work. It took me roughly a day
1316of work to discover this by experiment.
1317
1318On systems that have /dev/urandom, SSL may automatically seed itself from
1319there. Otherwise, we have to make something up as best we can. Double check
1320afterwards. */
1321
1322if (!RAND_status())
1323 {
1324 randstuff r;
9e3331ea 1325 gettimeofday(&r.tv, NULL);
059ec3d9
PH
1326 r.p = getpid();
1327
1328 RAND_seed((uschar *)(&r), sizeof(r));
1329 RAND_seed((uschar *)big_buffer, big_buffer_size);
1330 if (addr != NULL) RAND_seed((uschar *)addr, sizeof(addr));
1331
1332 if (!RAND_status())
7199e1ee 1333 return tls_error(US"RAND_status", host,
5ca6d115 1334 US"unable to seed random number generator");
059ec3d9
PH
1335 }
1336
1337/* Set up the information callback, which outputs if debugging is at a suitable
1338level. */
1339
f69979cf 1340DEBUG(D_tls) SSL_CTX_set_info_callback(*ctxp, (void (*)())info_callback);
059ec3d9 1341
c80c5570 1342/* Automatically re-try reads/writes after renegotiation. */
817d9f57 1343(void) SSL_CTX_set_mode(*ctxp, SSL_MODE_AUTO_RETRY);
c80c5570 1344
77bb000f
PP
1345/* Apply administrator-supplied work-arounds.
1346Historically we applied just one requested option,
1347SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
1348moved to an administrator-controlled list of options to specify and
1349grandfathered in the first one as the default value for "openssl_options".
059ec3d9 1350
77bb000f
PP
1351No OpenSSL version number checks: the options we accept depend upon the
1352availability of the option value macros from OpenSSL. */
059ec3d9 1353
77bb000f
PP
1354okay = tls_openssl_options_parse(openssl_options, &init_options);
1355if (!okay)
73a46702 1356 return tls_error(US"openssl_options parsing failed", host, NULL);
77bb000f
PP
1357
1358if (init_options)
1359 {
1360 DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
817d9f57 1361 if (!(SSL_CTX_set_options(*ctxp, init_options)))
77bb000f
PP
1362 return tls_error(string_sprintf(
1363 "SSL_CTX_set_option(%#lx)", init_options), host, NULL);
1364 }
1365else
1366 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
059ec3d9
PH
1367
1368/* Initialize with DH parameters if supplied */
10ca4f1c 1369/* Initialize ECDH temp key parameter selection */
059ec3d9 1370
038597d2
PP
1371if ( !init_dh(*ctxp, dhparam, host)
1372 || !init_ecdh(*ctxp, host)
1373 )
1374 return DEFER;
059ec3d9 1375
3f7eeb86 1376/* Set up certificate and key (and perhaps OCSP info) */
059ec3d9 1377
817d9f57 1378rc = tls_expand_session_files(*ctxp, cbinfo);
7be682ca 1379if (rc != OK) return rc;
c91535f3 1380
7be682ca 1381/* If we need to handle SNI, do so */
3bcbbbe2 1382#ifdef EXIM_HAVE_OPENSSL_TLSEXT
f5d78688 1383if (host == NULL) /* server */
3f0945ff 1384 {
f2de3a33 1385# ifndef DISABLE_OCSP
f5d78688 1386 /* We check u_ocsp.server.file, not server.response, because we care about if
3f7eeb86
PP
1387 the option exists, not what the current expansion might be, as SNI might
1388 change the certificate and OCSP file in use between now and the time the
1389 callback is invoked. */
f5d78688 1390 if (cbinfo->u_ocsp.server.file)
3f7eeb86 1391 {
f5d78688 1392 SSL_CTX_set_tlsext_status_cb(server_ctx, tls_server_stapling_cb);
5e55c7a9 1393 SSL_CTX_set_tlsext_status_arg(server_ctx, cbinfo);
3f7eeb86 1394 }
f5d78688 1395# endif
3f0945ff
PP
1396 /* We always do this, so that $tls_sni is available even if not used in
1397 tls_certificate */
817d9f57
JH
1398 SSL_CTX_set_tlsext_servername_callback(*ctxp, tls_servername_cb);
1399 SSL_CTX_set_tlsext_servername_arg(*ctxp, cbinfo);
3f0945ff 1400 }
f2de3a33 1401# ifndef DISABLE_OCSP
f5d78688
JH
1402else /* client */
1403 if(ocsp_file) /* wanting stapling */
1404 {
1405 if (!(cbinfo->u_ocsp.client.verify_store = X509_STORE_new()))
1406 {
1407 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
1408 return FAIL;
1409 }
1410 SSL_CTX_set_tlsext_status_cb(*ctxp, tls_client_stapling_cb);
1411 SSL_CTX_set_tlsext_status_arg(*ctxp, cbinfo);
1412 }
1413# endif
7be682ca 1414#endif
059ec3d9 1415
e51c7be2 1416cbinfo->verify_cert_hostnames = NULL;
e51c7be2 1417
059ec3d9
PH
1418/* Set up the RSA callback */
1419
817d9f57 1420SSL_CTX_set_tmp_rsa_callback(*ctxp, rsa_callback);
059ec3d9
PH
1421
1422/* Finally, set the timeout, and we are done */
1423
817d9f57 1424SSL_CTX_set_timeout(*ctxp, ssl_session_timeout);
059ec3d9 1425DEBUG(D_tls) debug_printf("Initialized TLS\n");
7be682ca 1426
817d9f57 1427*cbp = cbinfo;
7be682ca 1428
059ec3d9
PH
1429return OK;
1430}
1431
1432
1433
1434
1435/*************************************************
1436* Get name of cipher in use *
1437*************************************************/
1438
817d9f57 1439/*
059ec3d9 1440Argument: pointer to an SSL structure for the connection
817d9f57
JH
1441 buffer to use for answer
1442 size of buffer
1443 pointer to number of bits for cipher
059ec3d9
PH
1444Returns: nothing
1445*/
1446
1447static void
817d9f57 1448construct_cipher_name(SSL *ssl, uschar *cipherbuf, int bsize, int *bits)
059ec3d9 1449{
57b3a7f5
PP
1450/* With OpenSSL 1.0.0a, this needs to be const but the documentation doesn't
1451yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
1452the accessor functions use const in the prototype. */
1453const SSL_CIPHER *c;
d9784128 1454const uschar *ver;
059ec3d9 1455
d9784128 1456ver = (const uschar *)SSL_get_version(ssl);
059ec3d9 1457
57b3a7f5 1458c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
817d9f57 1459SSL_CIPHER_get_bits(c, bits);
059ec3d9 1460
817d9f57
JH
1461string_format(cipherbuf, bsize, "%s:%s:%u", ver,
1462 SSL_CIPHER_get_name(c), *bits);
059ec3d9
PH
1463
1464DEBUG(D_tls) debug_printf("Cipher: %s\n", cipherbuf);
1465}
1466
1467
f69979cf
JH
1468static void
1469peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned bsize)
1470{
1471/*XXX we might consider a list-of-certs variable for the cert chain.
1472SSL_get_peer_cert_chain(SSL*). We'd need a new variable type and support
1473in list-handling functions, also consider the difference between the entire
1474chain and the elements sent by the peer. */
1475
1476/* Will have already noted peercert on a verify fail; possibly not the leaf */
1477if (!tlsp->peercert)
1478 tlsp->peercert = SSL_get_peer_certificate(ssl);
1479/* Beware anonymous ciphers which lead to server_cert being NULL */
1480if (tlsp->peercert)
1481 {
1482 X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, bsize);
1483 peerdn[bsize-1] = '\0';
1484 tlsp->peerdn = peerdn; /*XXX a static buffer... */
1485 }
1486else
1487 tlsp->peerdn = NULL;
1488}
1489
1490
059ec3d9
PH
1491
1492
1493
1494/*************************************************
1495* Set up for verifying certificates *
1496*************************************************/
1497
1498/* Called by both client and server startup
1499
1500Arguments:
7be682ca 1501 sctx SSL_CTX* to initialise
059ec3d9
PH
1502 certs certs file or NULL
1503 crl CRL file or NULL
1504 host NULL in a server; the remote host in a client
1505 optional TRUE if called from a server for a host in tls_try_verify_hosts;
1506 otherwise passed as FALSE
983207c1 1507 cert_vfy_cb Callback function for certificate verification
059ec3d9
PH
1508
1509Returns: OK/DEFER/FAIL
1510*/
1511
1512static int
983207c1
JH
1513setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
1514 int (*cert_vfy_cb)(int, X509_STORE_CTX *) )
059ec3d9
PH
1515{
1516uschar *expcerts, *expcrl;
1517
1518if (!expand_check(certs, US"tls_verify_certificates", &expcerts))
1519 return DEFER;
1520
26e72755 1521if (expcerts != NULL && *expcerts != '\0')
059ec3d9 1522 {
cb1d7830 1523 if (Ustrcmp(expcerts, "system") == 0)
059ec3d9 1524 {
cb1d7830
JH
1525 /* Tell the library to use its compiled-in location for the system default
1526 CA bundle, only */
1527
1528 if (!SSL_CTX_set_default_verify_paths(sctx))
1529 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL);
059ec3d9
PH
1530 }
1531 else
1532 {
cb1d7830
JH
1533 struct stat statbuf;
1534
1535 /* Tell the library to use its compiled-in location for the system default
1536 CA bundle. Those given by the exim config are additional to these */
1537
1538 if (!SSL_CTX_set_default_verify_paths(sctx))
1539 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL);
1540
1541 if (Ustat(expcerts, &statbuf) < 0)
1542 {
1543 log_write(0, LOG_MAIN|LOG_PANIC,
1544 "failed to stat %s for certificates", expcerts);
1545 return DEFER;
1546 }
059ec3d9 1547 else
059ec3d9 1548 {
cb1d7830
JH
1549 uschar *file, *dir;
1550 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1551 { file = NULL; dir = expcerts; }
1552 else
1553 { file = expcerts; dir = NULL; }
1554
1555 /* If a certificate file is empty, the next function fails with an
1556 unhelpful error message. If we skip it, we get the correct behaviour (no
1557 certificates are recognized, but the error message is still misleading (it
1558 says no certificate was supplied.) But this is better. */
1559
1560 if ((file == NULL || statbuf.st_size > 0) &&
1561 !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
1562 return tls_error(US"SSL_CTX_load_verify_locations", host, NULL);
1563
1564 /* Load the list of CAs for which we will accept certs, for sending
1565 to the client. This is only for the one-file tls_verify_certificates
1566 variant.
1567 If a list isn't loaded into the server, but
1568 some verify locations are set, the server end appears to make
1569 a wildcard reqest for client certs.
1570 Meanwhile, the client library as deafult behaviour *ignores* the list
1571 we send over the wire - see man SSL_CTX_set_client_cert_cb.
1572 Because of this, and that the dir variant is likely only used for
1573 the public-CA bundle (not for a private CA), not worth fixing.
1574 */
1575 if (file != NULL)
1576 {
1577 STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
1578 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n",
1579 sk_X509_NAME_num(names));
1580 SSL_CTX_set_client_CA_list(sctx, names);
1581 }
059ec3d9
PH
1582 }
1583 }
1584
1585 /* Handle a certificate revocation list. */
1586
1587 #if OPENSSL_VERSION_NUMBER > 0x00907000L
1588
8b417f2c
PH
1589 /* This bit of code is now the version supplied by Lars Mainka. (I have
1590 * merely reformatted it into the Exim code style.)
1591
1592 * "From here I changed the code to add support for multiple crl's
1593 * in pem format in one file or to support hashed directory entries in
1594 * pem format instead of a file. This method now uses the library function
1595 * X509_STORE_load_locations to add the CRL location to the SSL context.
1596 * OpenSSL will then handle the verify against CA certs and CRLs by
1597 * itself in the verify callback." */
1598
059ec3d9
PH
1599 if (!expand_check(crl, US"tls_crl", &expcrl)) return DEFER;
1600 if (expcrl != NULL && *expcrl != 0)
1601 {
8b417f2c
PH
1602 struct stat statbufcrl;
1603 if (Ustat(expcrl, &statbufcrl) < 0)
1604 {
1605 log_write(0, LOG_MAIN|LOG_PANIC,
1606 "failed to stat %s for certificates revocation lists", expcrl);
1607 return DEFER;
1608 }
1609 else
059ec3d9 1610 {
8b417f2c
PH
1611 /* is it a file or directory? */
1612 uschar *file, *dir;
7be682ca 1613 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
8b417f2c 1614 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
059ec3d9 1615 {
8b417f2c
PH
1616 file = NULL;
1617 dir = expcrl;
1618 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
059ec3d9
PH
1619 }
1620 else
1621 {
8b417f2c
PH
1622 file = expcrl;
1623 dir = NULL;
1624 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
059ec3d9 1625 }
8b417f2c 1626 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
7199e1ee 1627 return tls_error(US"X509_STORE_load_locations", host, NULL);
8b417f2c
PH
1628
1629 /* setting the flags to check against the complete crl chain */
1630
1631 X509_STORE_set_flags(cvstore,
1632 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
059ec3d9 1633 }
059ec3d9
PH
1634 }
1635
1636 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
1637
1638 /* If verification is optional, don't fail if no certificate */
1639
7be682ca 1640 SSL_CTX_set_verify(sctx,
059ec3d9 1641 SSL_VERIFY_PEER | (optional? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
983207c1 1642 cert_vfy_cb);
059ec3d9
PH
1643 }
1644
1645return OK;
1646}
1647
1648
1649
1650/*************************************************
1651* Start a TLS session in a server *
1652*************************************************/
1653
1654/* This is called when Exim is running as a server, after having received
1655the STARTTLS command. It must respond to that command, and then negotiate
1656a TLS session.
1657
1658Arguments:
1659 require_ciphers allowed ciphers
1660
1661Returns: OK on success
1662 DEFER for errors before the start of the negotiation
1663 FAIL for errors during the negotation; the server can't
1664 continue running.
1665*/
1666
1667int
17c76198 1668tls_server_start(const uschar *require_ciphers)
059ec3d9
PH
1669{
1670int rc;
1671uschar *expciphers;
7be682ca 1672tls_ext_ctx_cb *cbinfo;
f69979cf 1673static uschar peerdn[256];
817d9f57 1674static uschar cipherbuf[256];
059ec3d9
PH
1675
1676/* Check for previous activation */
1677
817d9f57 1678if (tls_in.active >= 0)
059ec3d9 1679 {
5ca6d115 1680 tls_error(US"STARTTLS received after TLS started", NULL, US"");
059ec3d9
PH
1681 smtp_printf("554 Already in TLS\r\n");
1682 return FAIL;
1683 }
1684
1685/* Initialize the SSL library. If it fails, it will already have logged
1686the error. */
1687
817d9f57 1688rc = tls_init(&server_ctx, NULL, tls_dhparam, tls_certificate, tls_privatekey,
f2de3a33 1689#ifndef DISABLE_OCSP
3f7eeb86
PP
1690 tls_ocsp_file,
1691#endif
817d9f57 1692 NULL, &server_static_cbinfo);
059ec3d9 1693if (rc != OK) return rc;
817d9f57 1694cbinfo = server_static_cbinfo;
059ec3d9
PH
1695
1696if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers))
1697 return FAIL;
1698
1699/* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
17c76198
PP
1700were historically separated by underscores. So that I can use either form in my
1701tests, and also for general convenience, we turn underscores into hyphens here.
1702*/
059ec3d9
PH
1703
1704if (expciphers != NULL)
1705 {
1706 uschar *s = expciphers;
1707 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1708 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
817d9f57 1709 if (!SSL_CTX_set_cipher_list(server_ctx, CS expciphers))
7199e1ee 1710 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL);
7be682ca 1711 cbinfo->server_cipher_list = expciphers;
059ec3d9
PH
1712 }
1713
1714/* If this is a host for which certificate verification is mandatory or
1715optional, set up appropriately. */
1716
817d9f57 1717tls_in.certificate_verified = FALSE;
53a7196b
JH
1718#ifdef EXPERIMENTAL_DANE
1719tls_in.dane_verified = FALSE;
1720#endif
a2ff477a 1721server_verify_callback_called = FALSE;
059ec3d9
PH
1722
1723if (verify_check_host(&tls_verify_hosts) == OK)
1724 {
983207c1
JH
1725 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1726 FALSE, verify_callback_server);
059ec3d9 1727 if (rc != OK) return rc;
a2ff477a 1728 server_verify_optional = FALSE;
059ec3d9
PH
1729 }
1730else if (verify_check_host(&tls_try_verify_hosts) == OK)
1731 {
983207c1
JH
1732 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1733 TRUE, verify_callback_server);
059ec3d9 1734 if (rc != OK) return rc;
a2ff477a 1735 server_verify_optional = TRUE;
059ec3d9
PH
1736 }
1737
1738/* Prepare for new connection */
1739
817d9f57 1740if ((server_ssl = SSL_new(server_ctx)) == NULL) return tls_error(US"SSL_new", NULL, NULL);
da3ad30d
PP
1741
1742/* Warning: we used to SSL_clear(ssl) here, it was removed.
1743 *
1744 * With the SSL_clear(), we get strange interoperability bugs with
1745 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
1746 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
1747 *
1748 * The SSL_clear() call is to let an existing SSL* be reused, typically after
1749 * session shutdown. In this case, we have a brand new object and there's no
1750 * obvious reason to immediately clear it. I'm guessing that this was
1751 * originally added because of incomplete initialisation which the clear fixed,
1752 * in some historic release.
1753 */
059ec3d9
PH
1754
1755/* Set context and tell client to go ahead, except in the case of TLS startup
1756on connection, where outputting anything now upsets the clients and tends to
1757make them disconnect. We need to have an explicit fflush() here, to force out
1758the response. Other smtp_printf() calls do not need it, because in non-TLS
1759mode, the fflush() happens when smtp_getc() is called. */
1760
817d9f57
JH
1761SSL_set_session_id_context(server_ssl, sid_ctx, Ustrlen(sid_ctx));
1762if (!tls_in.on_connect)
059ec3d9
PH
1763 {
1764 smtp_printf("220 TLS go ahead\r\n");
1765 fflush(smtp_out);
1766 }
1767
1768/* Now negotiate the TLS session. We put our own timer on it, since it seems
1769that the OpenSSL library doesn't. */
1770
817d9f57
JH
1771SSL_set_wfd(server_ssl, fileno(smtp_out));
1772SSL_set_rfd(server_ssl, fileno(smtp_in));
1773SSL_set_accept_state(server_ssl);
059ec3d9
PH
1774
1775DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
1776
1777sigalrm_seen = FALSE;
1778if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
817d9f57 1779rc = SSL_accept(server_ssl);
059ec3d9
PH
1780alarm(0);
1781
1782if (rc <= 0)
1783 {
7199e1ee 1784 tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL);
77bb000f
PP
1785 if (ERR_get_error() == 0)
1786 log_write(0, LOG_MAIN,
a053d125 1787 "TLS client disconnected cleanly (rejected our certificate?)");
059ec3d9
PH
1788 return FAIL;
1789 }
1790
1791DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
1792
1793/* TLS has been set up. Adjust the input functions to read via TLS,
1794and initialize things. */
1795
f69979cf
JH
1796peer_cert(server_ssl, &tls_in, peerdn, sizeof(peerdn));
1797
817d9f57
JH
1798construct_cipher_name(server_ssl, cipherbuf, sizeof(cipherbuf), &tls_in.bits);
1799tls_in.cipher = cipherbuf;
059ec3d9
PH
1800
1801DEBUG(D_tls)
1802 {
1803 uschar buf[2048];
817d9f57 1804 if (SSL_get_shared_ciphers(server_ssl, CS buf, sizeof(buf)) != NULL)
059ec3d9
PH
1805 debug_printf("Shared ciphers: %s\n", buf);
1806 }
1807
9d1c15ef
JH
1808/* Record the certificate we presented */
1809 {
1810 X509 * crt = SSL_get_certificate(server_ssl);
1811 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
1812 }
059ec3d9 1813
817d9f57
JH
1814/* Only used by the server-side tls (tls_in), including tls_getc.
1815 Client-side (tls_out) reads (seem to?) go via
1816 smtp_read_response()/ip_recv().
1817 Hence no need to duplicate for _in and _out.
1818 */
059ec3d9
PH
1819ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1820ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
1821ssl_xfer_eof = ssl_xfer_error = 0;
1822
1823receive_getc = tls_getc;
1824receive_ungetc = tls_ungetc;
1825receive_feof = tls_feof;
1826receive_ferror = tls_ferror;
58eb016e 1827receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 1828
817d9f57 1829tls_in.active = fileno(smtp_out);
059ec3d9
PH
1830return OK;
1831}
1832
1833
1834
1835
043b1248
JH
1836static int
1837tls_client_basic_ctx_init(SSL_CTX * ctx,
01a4a5c5 1838 host_item * host, smtp_transport_options_block * ob, tls_ext_ctx_cb * cbinfo
043b1248
JH
1839 )
1840{
1841int rc;
94431adb 1842/* stick to the old behaviour for compatibility if tls_verify_certificates is
043b1248
JH
1843 set but both tls_verify_hosts and tls_try_verify_hosts is not set. Check only
1844 the specified host patterns if one of them is defined */
1845
610ff438
JH
1846if ( ( !ob->tls_verify_hosts
1847 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
1848 )
5130845b 1849 || (verify_check_given_host(&ob->tls_verify_hosts, host) == OK)
aa2a70ba 1850 )
043b1248 1851 client_verify_optional = FALSE;
5130845b 1852else if (verify_check_given_host(&ob->tls_try_verify_hosts, host) == OK)
aa2a70ba
JH
1853 client_verify_optional = TRUE;
1854else
1855 return OK;
1856
1857if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
1858 ob->tls_crl, host, client_verify_optional, verify_callback_client)) != OK)
1859 return rc;
043b1248 1860
5130845b 1861if (verify_check_given_host(&ob->tls_verify_cert_hostnames, host) == OK)
043b1248 1862 {
4af0d74a 1863 cbinfo->verify_cert_hostnames =
8c5d388a 1864#ifdef SUPPORT_I18N
4af0d74a
JH
1865 string_domain_utf8_to_alabel(host->name, NULL);
1866#else
1867 host->name;
1868#endif
aa2a70ba
JH
1869 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
1870 cbinfo->verify_cert_hostnames);
043b1248 1871 }
043b1248
JH
1872return OK;
1873}
059ec3d9 1874
fde080a4
JH
1875
1876#ifdef EXPERIMENTAL_DANE
1877static int
fde080a4
JH
1878dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa)
1879{
1880dns_record * rr;
1881dns_scan dnss;
1882const char * hostnames[2] = { CS host->name, NULL };
1883int found = 0;
1884
1885if (DANESSL_init(ssl, NULL, hostnames) != 1)
1886 return tls_error(US"hostnames load", host, NULL);
1887
1888for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
1889 rr;
1890 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
1891 ) if (rr->type == T_TLSA)
1892 {
1893 uschar * p = rr->data;
1894 uint8_t usage, selector, mtype;
1895 const char * mdname;
1896
fde080a4 1897 usage = *p++;
133d2546
JH
1898
1899 /* Only DANE-TA(2) and DANE-EE(3) are supported */
1900 if (usage != 2 && usage != 3) continue;
1901
fde080a4
JH
1902 selector = *p++;
1903 mtype = *p++;
1904
1905 switch (mtype)
1906 {
133d2546
JH
1907 default: continue; /* Only match-types 0, 1, 2 are supported */
1908 case 0: mdname = NULL; break;
1909 case 1: mdname = "sha256"; break;
1910 case 2: mdname = "sha512"; break;
fde080a4
JH
1911 }
1912
133d2546 1913 found++;
fde080a4
JH
1914 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
1915 {
1916 default:
1917 case 0: /* action not taken */
1918 return tls_error(US"tlsa load", host, NULL);
1919 case 1: break;
1920 }
594706ea
JH
1921
1922 tls_out.tlsa_usage |= 1<<usage;
fde080a4
JH
1923 }
1924
1925if (found)
1926 return OK;
1927
133d2546 1928log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
6ebd79ec 1929return DEFER;
fde080a4
JH
1930}
1931#endif /*EXPERIMENTAL_DANE*/
1932
1933
1934
059ec3d9
PH
1935/*************************************************
1936* Start a TLS session in a client *
1937*************************************************/
1938
1939/* Called from the smtp transport after STARTTLS has been accepted.
1940
1941Argument:
1942 fd the fd of the connection
1943 host connected host (for messages)
83da1223 1944 addr the first address
a7538db1 1945 tb transport (always smtp)
0e66b3b6 1946 tlsa_dnsa tlsa lookup, if DANE, else null
059ec3d9
PH
1947
1948Returns: OK on success
1949 FAIL otherwise - note that tls_error() will not give DEFER
1950 because this is not a server
1951*/
1952
1953int
f5d78688 1954tls_client_start(int fd, host_item *host, address_item *addr,
0e66b3b6
JH
1955 transport_instance *tb
1956#ifdef EXPERIMENTAL_DANE
1957 , dns_answer * tlsa_dnsa
1958#endif
1959 )
059ec3d9 1960{
a7538db1
JH
1961smtp_transport_options_block * ob =
1962 (smtp_transport_options_block *)tb->options_block;
f69979cf 1963static uschar peerdn[256];
868f5672 1964uschar * expciphers;
059ec3d9 1965int rc;
817d9f57 1966static uschar cipherbuf[256];
043b1248
JH
1967
1968#ifndef DISABLE_OCSP
043b1248 1969BOOL request_ocsp = FALSE;
6634ac8d 1970BOOL require_ocsp = FALSE;
043b1248 1971#endif
043b1248
JH
1972
1973#ifdef EXPERIMENTAL_DANE
594706ea 1974tls_out.tlsa_usage = 0;
043b1248
JH
1975#endif
1976
f2de3a33 1977#ifndef DISABLE_OCSP
043b1248 1978 {
4f59c424
JH
1979# ifdef EXPERIMENTAL_DANE
1980 if ( tlsa_dnsa
1981 && ob->hosts_request_ocsp[0] == '*'
1982 && ob->hosts_request_ocsp[1] == '\0'
1983 )
1984 {
1985 /* Unchanged from default. Use a safer one under DANE */
1986 request_ocsp = TRUE;
1987 ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
1988 " {= {4}{$tls_out_tlsa_usage}} } "
1989 " {*}{}}";
1990 }
1991# endif
1992
5130845b
JH
1993 if ((require_ocsp =
1994 verify_check_given_host(&ob->hosts_require_ocsp, host) == OK))
fca41d5a
JH
1995 request_ocsp = TRUE;
1996 else
fca41d5a 1997# ifdef EXPERIMENTAL_DANE
4f59c424 1998 if (!request_ocsp)
fca41d5a 1999# endif
5130845b
JH
2000 request_ocsp =
2001 verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
043b1248 2002 }
f5d78688 2003#endif
059ec3d9 2004
65867078
JH
2005rc = tls_init(&client_ctx, host, NULL,
2006 ob->tls_certificate, ob->tls_privatekey,
f2de3a33 2007#ifndef DISABLE_OCSP
44662487 2008 (void *)(long)request_ocsp,
3f7eeb86 2009#endif
817d9f57 2010 addr, &client_static_cbinfo);
059ec3d9
PH
2011if (rc != OK) return rc;
2012
817d9f57 2013tls_out.certificate_verified = FALSE;
a2ff477a 2014client_verify_callback_called = FALSE;
059ec3d9 2015
65867078
JH
2016if (!expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
2017 &expciphers))
059ec3d9
PH
2018 return FAIL;
2019
2020/* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
2021are separated by underscores. So that I can use either form in my tests, and
2022also for general convenience, we turn underscores into hyphens here. */
2023
2024if (expciphers != NULL)
2025 {
2026 uschar *s = expciphers;
2027 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
2028 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
817d9f57 2029 if (!SSL_CTX_set_cipher_list(client_ctx, CS expciphers))
7199e1ee 2030 return tls_error(US"SSL_CTX_set_cipher_list", host, NULL);
059ec3d9
PH
2031 }
2032
043b1248 2033#ifdef EXPERIMENTAL_DANE
0e66b3b6 2034if (tlsa_dnsa)
a63be306 2035 {
02af313d
JH
2036 SSL_CTX_set_verify(client_ctx,
2037 SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
2038 verify_callback_client_dane);
e5cccda9 2039
043b1248 2040 if (!DANESSL_library_init())
b4161d10 2041 return tls_error(US"library init", host, NULL);
043b1248 2042 if (DANESSL_CTX_init(client_ctx) <= 0)
b4161d10 2043 return tls_error(US"context init", host, NULL);
043b1248
JH
2044 }
2045else
e51c7be2 2046
043b1248
JH
2047#endif
2048
01a4a5c5
JH
2049 if ((rc = tls_client_basic_ctx_init(client_ctx, host, ob, client_static_cbinfo))
2050 != OK)
65867078 2051 return rc;
059ec3d9 2052
65867078
JH
2053if ((client_ssl = SSL_new(client_ctx)) == NULL)
2054 return tls_error(US"SSL_new", host, NULL);
817d9f57
JH
2055SSL_set_session_id_context(client_ssl, sid_ctx, Ustrlen(sid_ctx));
2056SSL_set_fd(client_ssl, fd);
2057SSL_set_connect_state(client_ssl);
059ec3d9 2058
65867078 2059if (ob->tls_sni)
3f0945ff 2060 {
65867078 2061 if (!expand_check(ob->tls_sni, US"tls_sni", &tls_out.sni))
3f0945ff 2062 return FAIL;
ec4b68e5 2063 if (tls_out.sni == NULL)
2c9a0e86
PP
2064 {
2065 DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
2066 }
ec4b68e5 2067 else if (!Ustrlen(tls_out.sni))
817d9f57 2068 tls_out.sni = NULL;
3f0945ff
PP
2069 else
2070 {
35731706 2071#ifdef EXIM_HAVE_OPENSSL_TLSEXT
817d9f57
JH
2072 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tls_out.sni);
2073 SSL_set_tlsext_host_name(client_ssl, tls_out.sni);
35731706
PP
2074#else
2075 DEBUG(D_tls)
2076 debug_printf("OpenSSL at build-time lacked SNI support, ignoring \"%s\"\n",
02d9264f 2077 tls_out.sni);
35731706 2078#endif
3f0945ff
PP
2079 }
2080 }
2081
594706ea 2082#ifdef EXPERIMENTAL_DANE
0e66b3b6
JH
2083if (tlsa_dnsa)
2084 if ((rc = dane_tlsa_load(client_ssl, host, tlsa_dnsa)) != OK)
594706ea
JH
2085 return rc;
2086#endif
2087
f2de3a33 2088#ifndef DISABLE_OCSP
f5d78688
JH
2089/* Request certificate status at connection-time. If the server
2090does OCSP stapling we will get the callback (set in tls_init()) */
b50c8b84 2091# ifdef EXPERIMENTAL_DANE
44662487
JH
2092if (request_ocsp)
2093 {
594706ea 2094 const uschar * s;
41afb5cb
JH
2095 if ( ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
2096 || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
594706ea
JH
2097 )
2098 { /* Re-eval now $tls_out_tlsa_usage is populated. If
2099 this means we avoid the OCSP request, we wasted the setup
2100 cost in tls_init(). */
5130845b
JH
2101 require_ocsp = verify_check_given_host(&ob->hosts_require_ocsp, host) == OK;
2102 request_ocsp = require_ocsp
2103 || verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
594706ea
JH
2104 }
2105 }
b50c8b84
JH
2106# endif
2107
594706ea
JH
2108if (request_ocsp)
2109 {
f5d78688 2110 SSL_set_tlsext_status_type(client_ssl, TLSEXT_STATUSTYPE_ocsp);
44662487
JH
2111 client_static_cbinfo->u_ocsp.client.verify_required = require_ocsp;
2112 tls_out.ocsp = OCSP_NOT_RESP;
2113 }
f5d78688
JH
2114#endif
2115
0cbf2b82 2116#ifndef DISABLE_EVENT
774ef2d7 2117client_static_cbinfo->event_action = tb->event_action;
a7538db1 2118#endif
043b1248 2119
059ec3d9
PH
2120/* There doesn't seem to be a built-in timeout on connection. */
2121
2122DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
2123sigalrm_seen = FALSE;
65867078 2124alarm(ob->command_timeout);
817d9f57 2125rc = SSL_connect(client_ssl);
059ec3d9
PH
2126alarm(0);
2127
043b1248 2128#ifdef EXPERIMENTAL_DANE
0e66b3b6 2129if (tlsa_dnsa)
fde080a4 2130 DANESSL_cleanup(client_ssl);
043b1248
JH
2131#endif
2132
059ec3d9 2133if (rc <= 0)
7199e1ee 2134 return tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL);
059ec3d9
PH
2135
2136DEBUG(D_tls) debug_printf("SSL_connect succeeded\n");
2137
f69979cf 2138peer_cert(client_ssl, &tls_out, peerdn, sizeof(peerdn));
059ec3d9 2139
817d9f57
JH
2140construct_cipher_name(client_ssl, cipherbuf, sizeof(cipherbuf), &tls_out.bits);
2141tls_out.cipher = cipherbuf;
059ec3d9 2142
9d1c15ef
JH
2143/* Record the certificate we presented */
2144 {
2145 X509 * crt = SSL_get_certificate(client_ssl);
2146 tls_out.ourcert = crt ? X509_dup(crt) : NULL;
2147 }
2148
817d9f57 2149tls_out.active = fd;
059ec3d9
PH
2150return OK;
2151}
2152
2153
2154
2155
2156
2157/*************************************************
2158* TLS version of getc *
2159*************************************************/
2160
2161/* This gets the next byte from the TLS input buffer. If the buffer is empty,
2162it refills the buffer via the SSL reading function.
2163
2164Arguments: none
2165Returns: the next character or EOF
817d9f57
JH
2166
2167Only used by the server-side TLS.
059ec3d9
PH
2168*/
2169
2170int
2171tls_getc(void)
2172{
2173if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
2174 {
2175 int error;
2176 int inbytes;
2177
817d9f57 2178 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", server_ssl,
c80c5570 2179 ssl_xfer_buffer, ssl_xfer_buffer_size);
059ec3d9
PH
2180
2181 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
817d9f57
JH
2182 inbytes = SSL_read(server_ssl, CS ssl_xfer_buffer, ssl_xfer_buffer_size);
2183 error = SSL_get_error(server_ssl, inbytes);
059ec3d9
PH
2184 alarm(0);
2185
2186 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
2187 closed down, not that the socket itself has been closed down. Revert to
2188 non-SSL handling. */
2189
2190 if (error == SSL_ERROR_ZERO_RETURN)
2191 {
2192 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2193
2194 receive_getc = smtp_getc;
2195 receive_ungetc = smtp_ungetc;
2196 receive_feof = smtp_feof;
2197 receive_ferror = smtp_ferror;
58eb016e 2198 receive_smtp_buffered = smtp_buffered;
059ec3d9 2199
817d9f57
JH
2200 SSL_free(server_ssl);
2201 server_ssl = NULL;
2202 tls_in.active = -1;
2203 tls_in.bits = 0;
2204 tls_in.cipher = NULL;
2205 tls_in.peerdn = NULL;
2206 tls_in.sni = NULL;
059ec3d9
PH
2207
2208 return smtp_getc();
2209 }
2210
2211 /* Handle genuine errors */
2212
ba084640
PP
2213 else if (error == SSL_ERROR_SSL)
2214 {
2215 ERR_error_string(ERR_get_error(), ssl_errstring);
89dd51cd 2216 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
ba084640
PP
2217 ssl_xfer_error = 1;
2218 return EOF;
2219 }
2220
059ec3d9
PH
2221 else if (error != SSL_ERROR_NONE)
2222 {
2223 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
2224 ssl_xfer_error = 1;
2225 return EOF;
2226 }
c80c5570 2227
80a47a2c
TK
2228#ifndef DISABLE_DKIM
2229 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
2230#endif
059ec3d9
PH
2231 ssl_xfer_buffer_hwm = inbytes;
2232 ssl_xfer_buffer_lwm = 0;
2233 }
2234
2235/* Something in the buffer; return next uschar */
2236
2237return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
2238}
2239
2240
2241
2242/*************************************************
2243* Read bytes from TLS channel *
2244*************************************************/
2245
2246/*
2247Arguments:
2248 buff buffer of data
2249 len size of buffer
2250
2251Returns: the number of bytes read
2252 -1 after a failed read
817d9f57
JH
2253
2254Only used by the client-side TLS.
059ec3d9
PH
2255*/
2256
2257int
389ca47a 2258tls_read(BOOL is_server, uschar *buff, size_t len)
059ec3d9 2259{
389ca47a 2260SSL *ssl = is_server ? server_ssl : client_ssl;
059ec3d9
PH
2261int inbytes;
2262int error;
2263
389ca47a 2264DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
c80c5570 2265 buff, (unsigned int)len);
059ec3d9 2266
389ca47a
JH
2267inbytes = SSL_read(ssl, CS buff, len);
2268error = SSL_get_error(ssl, inbytes);
059ec3d9
PH
2269
2270if (error == SSL_ERROR_ZERO_RETURN)
2271 {
2272 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2273 return -1;
2274 }
2275else if (error != SSL_ERROR_NONE)
2276 {
2277 return -1;
2278 }
2279
2280return inbytes;
2281}
2282
2283
2284
2285
2286
2287/*************************************************
2288* Write bytes down TLS channel *
2289*************************************************/
2290
2291/*
2292Arguments:
817d9f57 2293 is_server channel specifier
059ec3d9
PH
2294 buff buffer of data
2295 len number of bytes
2296
2297Returns: the number of bytes after a successful write,
2298 -1 after a failed write
817d9f57
JH
2299
2300Used by both server-side and client-side TLS.
059ec3d9
PH
2301*/
2302
2303int
817d9f57 2304tls_write(BOOL is_server, const uschar *buff, size_t len)
059ec3d9
PH
2305{
2306int outbytes;
2307int error;
2308int left = len;
817d9f57 2309SSL *ssl = is_server ? server_ssl : client_ssl;
059ec3d9 2310
c80c5570 2311DEBUG(D_tls) debug_printf("tls_do_write(%p, %d)\n", buff, left);
059ec3d9
PH
2312while (left > 0)
2313 {
c80c5570 2314 DEBUG(D_tls) debug_printf("SSL_write(SSL, %p, %d)\n", buff, left);
059ec3d9
PH
2315 outbytes = SSL_write(ssl, CS buff, left);
2316 error = SSL_get_error(ssl, outbytes);
2317 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
2318 switch (error)
2319 {
2320 case SSL_ERROR_SSL:
2321 ERR_error_string(ERR_get_error(), ssl_errstring);
2322 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
2323 return -1;
2324
2325 case SSL_ERROR_NONE:
2326 left -= outbytes;
2327 buff += outbytes;
2328 break;
2329
2330 case SSL_ERROR_ZERO_RETURN:
2331 log_write(0, LOG_MAIN, "SSL channel closed on write");
2332 return -1;
2333
817d9f57
JH
2334 case SSL_ERROR_SYSCALL:
2335 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
2336 sender_fullhost ? sender_fullhost : US"<unknown>",
2337 strerror(errno));
2338
059ec3d9
PH
2339 default:
2340 log_write(0, LOG_MAIN, "SSL_write error %d", error);
2341 return -1;
2342 }
2343 }
2344return len;
2345}
2346
2347
2348
2349/*************************************************
2350* Close down a TLS session *
2351*************************************************/
2352
2353/* This is also called from within a delivery subprocess forked from the
2354daemon, to shut down the TLS library, without actually doing a shutdown (which
2355would tamper with the SSL session in the parent process).
2356
2357Arguments: TRUE if SSL_shutdown is to be called
2358Returns: nothing
817d9f57
JH
2359
2360Used by both server-side and client-side TLS.
059ec3d9
PH
2361*/
2362
2363void
817d9f57 2364tls_close(BOOL is_server, BOOL shutdown)
059ec3d9 2365{
817d9f57 2366SSL **sslp = is_server ? &server_ssl : &client_ssl;
389ca47a 2367int *fdp = is_server ? &tls_in.active : &tls_out.active;
817d9f57
JH
2368
2369if (*fdp < 0) return; /* TLS was not active */
059ec3d9
PH
2370
2371if (shutdown)
2372 {
2373 DEBUG(D_tls) debug_printf("tls_close(): shutting down SSL\n");
817d9f57 2374 SSL_shutdown(*sslp);
059ec3d9
PH
2375 }
2376
817d9f57
JH
2377SSL_free(*sslp);
2378*sslp = NULL;
059ec3d9 2379
817d9f57 2380*fdp = -1;
059ec3d9
PH
2381}
2382
36f12725
NM
2383
2384
2385
2386/*************************************************
3375e053
PP
2387* Let tls_require_ciphers be checked at startup *
2388*************************************************/
2389
2390/* The tls_require_ciphers option, if set, must be something which the
2391library can parse.
2392
2393Returns: NULL on success, or error message
2394*/
2395
2396uschar *
2397tls_validate_require_cipher(void)
2398{
2399SSL_CTX *ctx;
2400uschar *s, *expciphers, *err;
2401
2402/* this duplicates from tls_init(), we need a better "init just global
2403state, for no specific purpose" singleton function of our own */
2404
2405SSL_load_error_strings();
2406OpenSSL_add_ssl_algorithms();
2407#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
2408/* SHA256 is becoming ever more popular. This makes sure it gets added to the
2409list of available digests. */
2410EVP_add_digest(EVP_sha256());
2411#endif
2412
2413if (!(tls_require_ciphers && *tls_require_ciphers))
2414 return NULL;
2415
2416if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
2417 return US"failed to expand tls_require_ciphers";
2418
2419if (!(expciphers && *expciphers))
2420 return NULL;
2421
2422/* normalisation ripped from above */
2423s = expciphers;
2424while (*s != 0) { if (*s == '_') *s = '-'; s++; }
2425
2426err = NULL;
2427
2428ctx = SSL_CTX_new(SSLv23_server_method());
2429if (!ctx)
2430 {
2431 ERR_error_string(ERR_get_error(), ssl_errstring);
2432 return string_sprintf("SSL_CTX_new() failed: %s", ssl_errstring);
2433 }
2434
2435DEBUG(D_tls)
2436 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2437
2438if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
2439 {
2440 ERR_error_string(ERR_get_error(), ssl_errstring);
2441 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed", expciphers);
2442 }
2443
2444SSL_CTX_free(ctx);
2445
2446return err;
2447}
2448
2449
2450
2451
2452/*************************************************
36f12725
NM
2453* Report the library versions. *
2454*************************************************/
2455
2456/* There have historically been some issues with binary compatibility in
2457OpenSSL libraries; if Exim (like many other applications) is built against
2458one version of OpenSSL but the run-time linker picks up another version,
2459it can result in serious failures, including crashing with a SIGSEGV. So
2460report the version found by the compiler and the run-time version.
2461
f64a1e23
PP
2462Note: some OS vendors backport security fixes without changing the version
2463number/string, and the version date remains unchanged. The _build_ date
2464will change, so we can more usefully assist with version diagnosis by also
2465reporting the build date.
2466
36f12725
NM
2467Arguments: a FILE* to print the results to
2468Returns: nothing
2469*/
2470
2471void
2472tls_version_report(FILE *f)
2473{
754a0503 2474fprintf(f, "Library version: OpenSSL: Compile: %s\n"
f64a1e23
PP
2475 " Runtime: %s\n"
2476 " : %s\n",
754a0503 2477 OPENSSL_VERSION_TEXT,
f64a1e23
PP
2478 SSLeay_version(SSLEAY_VERSION),
2479 SSLeay_version(SSLEAY_BUILT_ON));
2480/* third line is 38 characters for the %s and the line is 73 chars long;
2481the OpenSSL output includes a "built on: " prefix already. */
36f12725
NM
2482}
2483
9e3331ea
TK
2484
2485
2486
2487/*************************************************
17c76198 2488* Random number generation *
9e3331ea
TK
2489*************************************************/
2490
2491/* Pseudo-random number generation. The result is not expected to be
2492cryptographically strong but not so weak that someone will shoot themselves
2493in the foot using it as a nonce in input in some email header scheme or
2494whatever weirdness they'll twist this into. The result should handle fork()
2495and avoid repeating sequences. OpenSSL handles that for us.
2496
2497Arguments:
2498 max range maximum
2499Returns a random number in range [0, max-1]
2500*/
2501
2502int
17c76198 2503vaguely_random_number(int max)
9e3331ea
TK
2504{
2505unsigned int r;
2506int i, needed_len;
de6135a0
PP
2507static pid_t pidlast = 0;
2508pid_t pidnow;
9e3331ea
TK
2509uschar *p;
2510uschar smallbuf[sizeof(r)];
2511
2512if (max <= 1)
2513 return 0;
2514
de6135a0
PP
2515pidnow = getpid();
2516if (pidnow != pidlast)
2517 {
2518 /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
2519 is unique for each thread", this doesn't apparently apply across processes,
2520 so our own warning from vaguely_random_number_fallback() applies here too.
2521 Fix per PostgreSQL. */
2522 if (pidlast != 0)
2523 RAND_cleanup();
2524 pidlast = pidnow;
2525 }
2526
9e3331ea
TK
2527/* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
2528if (!RAND_status())
2529 {
2530 randstuff r;
2531 gettimeofday(&r.tv, NULL);
2532 r.p = getpid();
2533
2534 RAND_seed((uschar *)(&r), sizeof(r));
2535 }
2536/* We're after pseudo-random, not random; if we still don't have enough data
2537in the internal PRNG then our options are limited. We could sleep and hope
2538for entropy to come along (prayer technique) but if the system is so depleted
2539in the first place then something is likely to just keep taking it. Instead,
2540we'll just take whatever little bit of pseudo-random we can still manage to
2541get. */
2542
2543needed_len = sizeof(r);
2544/* Don't take 8 times more entropy than needed if int is 8 octets and we were
2545asked for a number less than 10. */
2546for (r = max, i = 0; r; ++i)
2547 r >>= 1;
2548i = (i + 7) / 8;
2549if (i < needed_len)
2550 needed_len = i;
2551
2552/* We do not care if crypto-strong */
17c76198
PP
2553i = RAND_pseudo_bytes(smallbuf, needed_len);
2554if (i < 0)
2555 {
2556 DEBUG(D_all)
2557 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
2558 return vaguely_random_number_fallback(max);
2559 }
2560
9e3331ea
TK
2561r = 0;
2562for (p = smallbuf; needed_len; --needed_len, ++p)
2563 {
2564 r *= 256;
2565 r += *p;
2566 }
2567
2568/* We don't particularly care about weighted results; if someone wants
2569smooth distribution and cares enough then they should submit a patch then. */
2570return r % max;
2571}
2572
77bb000f
PP
2573
2574
2575
2576/*************************************************
2577* OpenSSL option parse *
2578*************************************************/
2579
2580/* Parse one option for tls_openssl_options_parse below
2581
2582Arguments:
2583 name one option name
2584 value place to store a value for it
2585Returns success or failure in parsing
2586*/
2587
2588struct exim_openssl_option {
2589 uschar *name;
2590 long value;
2591};
2592/* We could use a macro to expand, but we need the ifdef and not all the
2593options document which version they were introduced in. Policylet: include
2594all options unless explicitly for DTLS, let the administrator choose which
2595to apply.
2596
2597This list is current as of:
e2fbf4a2
PP
2598 ==> 1.0.1b <==
2599Plus SSL_OP_SAFARI_ECDHE_ECDSA_BUG from 2013-June patch/discussion on openssl-dev
2600*/
77bb000f
PP
2601static struct exim_openssl_option exim_openssl_options[] = {
2602/* KEEP SORTED ALPHABETICALLY! */
2603#ifdef SSL_OP_ALL
73a46702 2604 { US"all", SSL_OP_ALL },
77bb000f
PP
2605#endif
2606#ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
73a46702 2607 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
77bb000f
PP
2608#endif
2609#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
73a46702 2610 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
77bb000f
PP
2611#endif
2612#ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
73a46702 2613 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
77bb000f
PP
2614#endif
2615#ifdef SSL_OP_EPHEMERAL_RSA
73a46702 2616 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
77bb000f
PP
2617#endif
2618#ifdef SSL_OP_LEGACY_SERVER_CONNECT
73a46702 2619 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
77bb000f
PP
2620#endif
2621#ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
73a46702 2622 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
77bb000f
PP
2623#endif
2624#ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
73a46702 2625 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
77bb000f
PP
2626#endif
2627#ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
73a46702 2628 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
77bb000f
PP
2629#endif
2630#ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
73a46702 2631 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
77bb000f
PP
2632#endif
2633#ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
73a46702 2634 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
77bb000f 2635#endif
c80c5570
PP
2636#ifdef SSL_OP_NO_COMPRESSION
2637 { US"no_compression", SSL_OP_NO_COMPRESSION },
2638#endif
77bb000f 2639#ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
73a46702 2640 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
77bb000f 2641#endif
c0c7b2da
PP
2642#ifdef SSL_OP_NO_SSLv2
2643 { US"no_sslv2", SSL_OP_NO_SSLv2 },
2644#endif
2645#ifdef SSL_OP_NO_SSLv3
2646 { US"no_sslv3", SSL_OP_NO_SSLv3 },
2647#endif
2648#ifdef SSL_OP_NO_TICKET
2649 { US"no_ticket", SSL_OP_NO_TICKET },
2650#endif
2651#ifdef SSL_OP_NO_TLSv1
2652 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
2653#endif
c80c5570
PP
2654#ifdef SSL_OP_NO_TLSv1_1
2655#if SSL_OP_NO_TLSv1_1 == 0x00000400L
2656 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
2657#warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
2658#else
2659 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
2660#endif
2661#endif
2662#ifdef SSL_OP_NO_TLSv1_2
2663 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
2664#endif
e2fbf4a2
PP
2665#ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
2666 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
2667#endif
77bb000f 2668#ifdef SSL_OP_SINGLE_DH_USE
73a46702 2669 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
77bb000f
PP
2670#endif
2671#ifdef SSL_OP_SINGLE_ECDH_USE
73a46702 2672 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
77bb000f
PP
2673#endif
2674#ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
73a46702 2675 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
77bb000f
PP
2676#endif
2677#ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
73a46702 2678 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
77bb000f
PP
2679#endif
2680#ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
73a46702 2681 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
77bb000f
PP
2682#endif
2683#ifdef SSL_OP_TLS_D5_BUG
73a46702 2684 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
77bb000f
PP
2685#endif
2686#ifdef SSL_OP_TLS_ROLLBACK_BUG
73a46702 2687 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
77bb000f
PP
2688#endif
2689};
2690static int exim_openssl_options_size =
2691 sizeof(exim_openssl_options)/sizeof(struct exim_openssl_option);
2692
c80c5570 2693
77bb000f
PP
2694static BOOL
2695tls_openssl_one_option_parse(uschar *name, long *value)
2696{
2697int first = 0;
2698int last = exim_openssl_options_size;
2699while (last > first)
2700 {
2701 int middle = (first + last)/2;
2702 int c = Ustrcmp(name, exim_openssl_options[middle].name);
2703 if (c == 0)
2704 {
2705 *value = exim_openssl_options[middle].value;
2706 return TRUE;
2707 }
2708 else if (c > 0)
2709 first = middle + 1;
2710 else
2711 last = middle;
2712 }
2713return FALSE;
2714}
2715
2716
2717
2718
2719/*************************************************
2720* OpenSSL option parsing logic *
2721*************************************************/
2722
2723/* OpenSSL has a number of compatibility options which an administrator might
2724reasonably wish to set. Interpret a list similarly to decode_bits(), so that
2725we look like log_selector.
2726
2727Arguments:
2728 option_spec the administrator-supplied string of options
2729 results ptr to long storage for the options bitmap
2730Returns success or failure
2731*/
2732
2733BOOL
2734tls_openssl_options_parse(uschar *option_spec, long *results)
2735{
2736long result, item;
2737uschar *s, *end;
2738uschar keep_c;
2739BOOL adding, item_parsed;
2740
0e944a0d 2741result = 0L;
b1770b6e 2742/* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
da3ad30d 2743 * from default because it increases BEAST susceptibility. */
f0f5a555
PP
2744#ifdef SSL_OP_NO_SSLv2
2745result |= SSL_OP_NO_SSLv2;
2746#endif
77bb000f
PP
2747
2748if (option_spec == NULL)
2749 {
2750 *results = result;
2751 return TRUE;
2752 }
2753
2754for (s=option_spec; *s != '\0'; /**/)
2755 {
2756 while (isspace(*s)) ++s;
2757 if (*s == '\0')
2758 break;
2759 if (*s != '+' && *s != '-')
2760 {
2761 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
0e944a0d 2762 "+ or - expected but found \"%s\"\n", s);
77bb000f
PP
2763 return FALSE;
2764 }
2765 adding = *s++ == '+';
2766 for (end = s; (*end != '\0') && !isspace(*end); ++end) /**/ ;
2767 keep_c = *end;
2768 *end = '\0';
2769 item_parsed = tls_openssl_one_option_parse(s, &item);
2770 if (!item_parsed)
2771 {
0e944a0d 2772 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
77bb000f
PP
2773 return FALSE;
2774 }
2775 DEBUG(D_tls) debug_printf("openssl option, %s from %lx: %lx (%s)\n",
2776 adding ? "adding" : "removing", result, item, s);
2777 if (adding)
2778 result |= item;
2779 else
2780 result &= ~item;
2781 *end = keep_c;
2782 s = end;
2783 }
2784
2785*results = result;
2786return TRUE;
2787}
2788
9d1c15ef
JH
2789/* vi: aw ai sw=2
2790*/
059ec3d9 2791/* End of tls-openssl.c */