Break out dane code to separate functions
[exim.git] / src / src / tls-openssl.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
5a66c31b 5/* Copyright (c) University of Cambridge 1995 - 2014 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
f5d78688
JH
8/* Portions Copyright (c) The OpenSSL Project 1999 */
9
059ec3d9
PH
10/* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
11library. It is #included into the tls.c file when that library is used. The
12code herein is based on a patch that was originally contributed by Steve
13Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
14
15No cryptographic code is included in Exim. All this module does is to call
16functions from the OpenSSL library. */
17
18
19/* Heading stuff */
20
21#include <openssl/lhash.h>
22#include <openssl/ssl.h>
23#include <openssl/err.h>
24#include <openssl/rand.h>
f2de3a33 25#ifndef DISABLE_OCSP
e51c7be2 26# include <openssl/ocsp.h>
3f7eeb86 27#endif
85098ee7
JH
28#ifdef EXPERIMENTAL_DANE
29# include <danessl.h>
30#endif
31
3f7eeb86 32
f2de3a33
JH
33#ifndef DISABLE_OCSP
34# define EXIM_OCSP_SKEW_SECONDS (300L)
35# define EXIM_OCSP_MAX_AGE (-1L)
3f7eeb86 36#endif
059ec3d9 37
3bcbbbe2 38#if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
e51c7be2 39# define EXIM_HAVE_OPENSSL_TLSEXT
3bcbbbe2
PP
40#endif
41
67791ce4
JH
42#if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
43# warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
44# define DISABLE_OCSP
45#endif
46
059ec3d9
PH
47/* Structure for collecting random data for seeding. */
48
49typedef struct randstuff {
9e3331ea
TK
50 struct timeval tv;
51 pid_t p;
059ec3d9
PH
52} randstuff;
53
54/* Local static variables */
55
a2ff477a
JH
56static BOOL client_verify_callback_called = FALSE;
57static BOOL server_verify_callback_called = FALSE;
059ec3d9
PH
58static const uschar *sid_ctx = US"exim";
59
d4f09789
PP
60/* We have three different contexts to care about.
61
62Simple case: client, `client_ctx`
63 As a client, we can be doing a callout or cut-through delivery while receiving
64 a message. So we have a client context, which should have options initialised
65 from the SMTP Transport.
66
67Server:
68 There are two cases: with and without ServerNameIndication from the client.
69 Given TLS SNI, we can be using different keys, certs and various other
70 configuration settings, because they're re-expanded with $tls_sni set. This
71 allows vhosting with TLS. This SNI is sent in the handshake.
72 A client might not send SNI, so we need a fallback, and an initial setup too.
73 So as a server, we start out using `server_ctx`.
74 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
75 `server_sni` from `server_ctx` and then initialise settings by re-expanding
76 configuration.
77*/
78
817d9f57
JH
79static SSL_CTX *client_ctx = NULL;
80static SSL_CTX *server_ctx = NULL;
81static SSL *client_ssl = NULL;
82static SSL *server_ssl = NULL;
389ca47a 83
35731706 84#ifdef EXIM_HAVE_OPENSSL_TLSEXT
817d9f57 85static SSL_CTX *server_sni = NULL;
35731706 86#endif
059ec3d9
PH
87
88static char ssl_errstring[256];
89
90static int ssl_session_timeout = 200;
a2ff477a
JH
91static BOOL client_verify_optional = FALSE;
92static BOOL server_verify_optional = FALSE;
059ec3d9 93
f5d78688 94static BOOL reexpand_tls_files_for_sni = FALSE;
059ec3d9
PH
95
96
7be682ca
PP
97typedef struct tls_ext_ctx_cb {
98 uschar *certificate;
99 uschar *privatekey;
f2de3a33 100#ifndef DISABLE_OCSP
f5d78688
JH
101 BOOL is_server;
102 union {
103 struct {
104 uschar *file;
105 uschar *file_expanded;
106 OCSP_RESPONSE *response;
107 } server;
108 struct {
44662487
JH
109 X509_STORE *verify_store; /* non-null if status requested */
110 BOOL verify_required;
f5d78688
JH
111 } client;
112 } u_ocsp;
3f7eeb86 113#endif
7be682ca
PP
114 uschar *dhparam;
115 /* these are cached from first expand */
116 uschar *server_cipher_list;
117 /* only passed down to tls_error: */
118 host_item *host;
e51c7be2
JH
119
120#ifdef EXPERIMENTAL_CERTNAMES
121 uschar * verify_cert_hostnames;
122#endif
7be682ca
PP
123} tls_ext_ctx_cb;
124
125/* should figure out a cleanup of API to handle state preserved per
126implementation, for various reasons, which can be void * in the APIs.
127For now, we hack around it. */
817d9f57
JH
128tls_ext_ctx_cb *client_static_cbinfo = NULL;
129tls_ext_ctx_cb *server_static_cbinfo = NULL;
7be682ca
PP
130
131static int
983207c1
JH
132setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
133 int (*cert_vfy_cb)(int, X509_STORE_CTX *) );
059ec3d9 134
3f7eeb86 135/* Callbacks */
3bcbbbe2 136#ifdef EXIM_HAVE_OPENSSL_TLSEXT
3f7eeb86 137static int tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg);
3bcbbbe2 138#endif
f2de3a33 139#ifndef DISABLE_OCSP
f5d78688 140static int tls_server_stapling_cb(SSL *s, void *arg);
3f7eeb86
PP
141#endif
142
059ec3d9
PH
143
144/*************************************************
145* Handle TLS error *
146*************************************************/
147
148/* Called from lots of places when errors occur before actually starting to do
149the TLS handshake, that is, while the session is still in clear. Always returns
150DEFER for a server and FAIL for a client so that most calls can use "return
151tls_error(...)" to do this processing and then give an appropriate return. A
152single function is used for both server and client, because it is called from
153some shared functions.
154
155Argument:
156 prefix text to include in the logged error
157 host NULL if setting up a server;
158 the connected host if setting up a client
7199e1ee 159 msg error message or NULL if we should ask OpenSSL
059ec3d9
PH
160
161Returns: OK/DEFER/FAIL
162*/
163
164static int
7199e1ee 165tls_error(uschar *prefix, host_item *host, uschar *msg)
059ec3d9 166{
7199e1ee
TF
167if (msg == NULL)
168 {
169 ERR_error_string(ERR_get_error(), ssl_errstring);
5ca6d115 170 msg = (uschar *)ssl_errstring;
7199e1ee
TF
171 }
172
059ec3d9
PH
173if (host == NULL)
174 {
7199e1ee 175 uschar *conn_info = smtp_get_connection_info();
5ca6d115 176 if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
7199e1ee
TF
177 conn_info += 5;
178 log_write(0, LOG_MAIN, "TLS error on %s (%s): %s",
179 conn_info, prefix, msg);
059ec3d9
PH
180 return DEFER;
181 }
182else
183 {
184 log_write(0, LOG_MAIN, "TLS error on connection to %s [%s] (%s): %s",
7199e1ee 185 host->name, host->address, prefix, msg);
059ec3d9
PH
186 return FAIL;
187 }
188}
189
190
191
192/*************************************************
193* Callback to generate RSA key *
194*************************************************/
195
196/*
197Arguments:
198 s SSL connection
199 export not used
200 keylength keylength
201
202Returns: pointer to generated key
203*/
204
205static RSA *
206rsa_callback(SSL *s, int export, int keylength)
207{
208RSA *rsa_key;
209export = export; /* Shut picky compilers up */
210DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
211rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL);
212if (rsa_key == NULL)
213 {
214 ERR_error_string(ERR_get_error(), ssl_errstring);
215 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
216 ssl_errstring);
217 return NULL;
218 }
219return rsa_key;
220}
221
222
223
f5d78688 224/* Extreme debug
f2de3a33 225#ifndef DISABLE_OCSP
f5d78688
JH
226void
227x509_store_dump_cert_s_names(X509_STORE * store)
228{
229STACK_OF(X509_OBJECT) * roots= store->objs;
230int i;
231static uschar name[256];
232
233for(i= 0; i<sk_X509_OBJECT_num(roots); i++)
234 {
235 X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
236 if(tmp_obj->type == X509_LU_X509)
237 {
238 X509 * current_cert= tmp_obj->data.x509;
239 X509_NAME_oneline(X509_get_subject_name(current_cert), CS name, sizeof(name));
240 debug_printf(" %s\n", name);
241 }
242 }
243}
244#endif
245*/
246
059ec3d9
PH
247
248/*************************************************
249* Callback for verification *
250*************************************************/
251
252/* The SSL library does certificate verification if set up to do so. This
253callback has the current yes/no state is in "state". If verification succeeded,
254we set up the tls_peerdn string. If verification failed, what happens depends
255on whether the client is required to present a verifiable certificate or not.
256
257If verification is optional, we change the state to yes, but still log the
258verification error. For some reason (it really would help to have proper
259documentation of OpenSSL), this callback function then gets called again, this
260time with state = 1. In fact, that's useful, because we can set up the peerdn
261value, but we must take care not to set the private verified flag on the second
262time through.
263
264Note: this function is not called if the client fails to present a certificate
265when asked. We get here only if a certificate has been received. Handling of
266optional verification for this case is done when requesting SSL to verify, by
267setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
268
269Arguments:
270 state current yes/no state as 1/0
271 x509ctx certificate information.
a2ff477a 272 client TRUE for client startup, FALSE for server startup
059ec3d9
PH
273
274Returns: 1 if verified, 0 if not
275*/
276
277static int
421aff85
JH
278verify_callback(int state, X509_STORE_CTX *x509ctx,
279 tls_support *tlsp, BOOL *calledp, BOOL *optionalp)
059ec3d9 280{
421aff85 281X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
059ec3d9
PH
282static uschar txt[256];
283
e51c7be2 284X509_NAME_oneline(X509_get_subject_name(cert), CS txt, sizeof(txt));
059ec3d9
PH
285
286if (state == 0)
287 {
288 log_write(0, LOG_MAIN, "SSL verify error: depth=%d error=%s cert=%s",
421aff85
JH
289 X509_STORE_CTX_get_error_depth(x509ctx),
290 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)),
059ec3d9 291 txt);
a2ff477a
JH
292 tlsp->certificate_verified = FALSE;
293 *calledp = TRUE;
9d1c15ef
JH
294 if (!*optionalp)
295 {
421aff85 296 tlsp->peercert = X509_dup(cert);
9d1c15ef
JH
297 return 0; /* reject */
298 }
059ec3d9
PH
299 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
300 "tls_try_verify_hosts)\n");
059ec3d9
PH
301 }
302
421aff85 303else if (X509_STORE_CTX_get_error_depth(x509ctx) != 0)
059ec3d9 304 {
93dcb1c2 305 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n",
421aff85 306 X509_STORE_CTX_get_error_depth(x509ctx), txt);
f2de3a33 307#ifndef DISABLE_OCSP
f5d78688
JH
308 if (tlsp == &tls_out && client_static_cbinfo->u_ocsp.client.verify_store)
309 { /* client, wanting stapling */
310 /* Add the server cert's signing chain as the one
311 for the verification of the OCSP stapled information. */
312
313 if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
421aff85 314 cert))
f5d78688
JH
315 ERR_clear_error();
316 }
317#endif
059ec3d9
PH
318 }
319else
320 {
e51c7be2
JH
321#ifdef EXPERIMENTAL_CERTNAMES
322 uschar * verify_cert_hostnames;
323#endif
324
a2ff477a 325 tlsp->peerdn = txt;
421aff85 326 tlsp->peercert = X509_dup(cert);
e51c7be2
JH
327
328#ifdef EXPERIMENTAL_CERTNAMES
329 if ( tlsp == &tls_out
330 && ((verify_cert_hostnames = client_static_cbinfo->verify_cert_hostnames)))
331 /* client, wanting hostname check */
332
333# if OPENSSL_VERSION_NUMBER >= 0x010100000L || OPENSSL_VERSION_NUMBER >= 0x010002000L
d8e7834a
JH
334# ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
335# define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
336# endif
e51c7be2
JH
337 {
338 int sep = 0;
339 uschar * list = verify_cert_hostnames;
340 uschar * name;
d8e7834a
JH
341 int rc;
342 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
343 if ((rc = X509_check_host(cert, name, 0,
344 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS)))
345 {
346 if (rc < 0)
347 {
348 log_write(0, LOG_MAIN, "SSL verify error: internal error\n");
349 name = NULL;
350 }
e51c7be2 351 break;
d8e7834a 352 }
e51c7be2
JH
353 if (!name)
354 {
355 log_write(0, LOG_MAIN,
356 "SSL verify error: certificate name mismatch: \"%s\"\n", txt);
357 return 0; /* reject */
358 }
359 }
360# else
361 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
362 {
363 log_write(0, LOG_MAIN,
364 "SSL verify error: certificate name mismatch: \"%s\"\n", txt);
365 return 0; /* reject */
366 }
367# endif
e5cccda9 368#endif /*EXPERIMENTAL_CERTNAMES*/
e51c7be2 369
93dcb1c2
JH
370 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
371 *calledp ? "" : " authenticated", txt);
372 if (!*calledp) tlsp->certificate_verified = TRUE;
373 *calledp = TRUE;
059ec3d9
PH
374 }
375
059ec3d9
PH
376return 1; /* accept */
377}
378
a2ff477a
JH
379static int
380verify_callback_client(int state, X509_STORE_CTX *x509ctx)
381{
f5d78688 382return verify_callback(state, x509ctx, &tls_out, &client_verify_callback_called, &client_verify_optional);
a2ff477a
JH
383}
384
385static int
386verify_callback_server(int state, X509_STORE_CTX *x509ctx)
387{
f5d78688 388return verify_callback(state, x509ctx, &tls_in, &server_verify_callback_called, &server_verify_optional);
a2ff477a
JH
389}
390
059ec3d9 391
e5cccda9 392#ifdef EXPERIMENTAL_DANE
53a7196b 393
e5cccda9
JH
394/* This gets called *by* the dane library verify callback, which interposes
395itself.
396*/
397static int
398verify_callback_client_dane(int state, X509_STORE_CTX * x509ctx)
399{
400X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
401static uschar txt[256];
402
403X509_NAME_oneline(X509_get_subject_name(cert), CS txt, sizeof(txt));
404
405DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s\n", txt);
406tls_out.peerdn = txt;
407tls_out.peercert = X509_dup(cert);
408
409if (state == 1)
53a7196b 410 tls_out.dane_verified =
e5cccda9
JH
411 tls_out.certificate_verified = TRUE;
412return 1;
413}
53a7196b
JH
414
415#endif /*EXPERIMENTAL_DANE*/
e5cccda9 416
059ec3d9
PH
417
418/*************************************************
419* Information callback *
420*************************************************/
421
422/* The SSL library functions call this from time to time to indicate what they
7be682ca
PP
423are doing. We copy the string to the debugging output when TLS debugging has
424been requested.
059ec3d9
PH
425
426Arguments:
427 s the SSL connection
428 where
429 ret
430
431Returns: nothing
432*/
433
434static void
435info_callback(SSL *s, int where, int ret)
436{
437where = where;
438ret = ret;
439DEBUG(D_tls) debug_printf("SSL info: %s\n", SSL_state_string_long(s));
440}
441
442
443
444/*************************************************
445* Initialize for DH *
446*************************************************/
447
448/* If dhparam is set, expand it, and load up the parameters for DH encryption.
449
450Arguments:
a799883d 451 dhparam DH parameter file or fixed parameter identity string
7199e1ee 452 host connected host, if client; NULL if server
059ec3d9
PH
453
454Returns: TRUE if OK (nothing to set up, or setup worked)
455*/
456
457static BOOL
a799883d 458init_dh(SSL_CTX *sctx, uschar *dhparam, host_item *host)
059ec3d9 459{
059ec3d9
PH
460BIO *bio;
461DH *dh;
462uschar *dhexpanded;
a799883d 463const char *pem;
059ec3d9
PH
464
465if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded))
466 return FALSE;
467
0df4ab80 468if (!dhexpanded || !*dhexpanded)
a799883d 469 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
a799883d 470else if (dhexpanded[0] == '/')
059ec3d9 471 {
0df4ab80 472 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
059ec3d9 473 {
7199e1ee 474 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
a799883d
PP
475 host, US strerror(errno));
476 return FALSE;
059ec3d9 477 }
a799883d
PP
478 }
479else
480 {
481 if (Ustrcmp(dhexpanded, "none") == 0)
059ec3d9 482 {
a799883d
PP
483 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
484 return TRUE;
059ec3d9 485 }
a799883d 486
0df4ab80 487 if (!(pem = std_dh_prime_named(dhexpanded)))
a799883d
PP
488 {
489 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
490 host, US strerror(errno));
491 return FALSE;
492 }
493 bio = BIO_new_mem_buf(CS pem, -1);
494 }
495
0df4ab80 496if (!(dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)))
a799883d 497 {
059ec3d9 498 BIO_free(bio);
a799883d
PP
499 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
500 host, NULL);
501 return FALSE;
502 }
503
504/* Even if it is larger, we silently return success rather than cause things
505 * to fail out, so that a too-large DH will not knock out all TLS; it's a
506 * debatable choice. */
507if ((8*DH_size(dh)) > tls_dh_max_bits)
508 {
509 DEBUG(D_tls)
510 debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d",
511 8*DH_size(dh), tls_dh_max_bits);
512 }
513else
514 {
515 SSL_CTX_set_tmp_dh(sctx, dh);
516 DEBUG(D_tls)
517 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
518 dhexpanded ? dhexpanded : US"default", 8*DH_size(dh));
059ec3d9
PH
519 }
520
a799883d
PP
521DH_free(dh);
522BIO_free(bio);
523
524return TRUE;
059ec3d9
PH
525}
526
527
528
529
f2de3a33 530#ifndef DISABLE_OCSP
3f7eeb86
PP
531/*************************************************
532* Load OCSP information into state *
533*************************************************/
534
f5d78688 535/* Called to load the server OCSP response from the given file into memory, once
3f7eeb86
PP
536caller has determined this is needed. Checks validity. Debugs a message
537if invalid.
538
539ASSUMES: single response, for single cert.
540
541Arguments:
542 sctx the SSL_CTX* to update
543 cbinfo various parts of session state
544 expanded the filename putatively holding an OCSP response
545
546*/
547
548static void
f5d78688 549ocsp_load_response(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo, const uschar *expanded)
3f7eeb86
PP
550{
551BIO *bio;
552OCSP_RESPONSE *resp;
553OCSP_BASICRESP *basic_response;
554OCSP_SINGLERESP *single_response;
555ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
556X509_STORE *store;
557unsigned long verify_flags;
558int status, reason, i;
559
f5d78688
JH
560cbinfo->u_ocsp.server.file_expanded = string_copy(expanded);
561if (cbinfo->u_ocsp.server.response)
3f7eeb86 562 {
f5d78688
JH
563 OCSP_RESPONSE_free(cbinfo->u_ocsp.server.response);
564 cbinfo->u_ocsp.server.response = NULL;
3f7eeb86
PP
565 }
566
f5d78688 567bio = BIO_new_file(CS cbinfo->u_ocsp.server.file_expanded, "rb");
3f7eeb86
PP
568if (!bio)
569 {
570 DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
f5d78688 571 cbinfo->u_ocsp.server.file_expanded);
3f7eeb86
PP
572 return;
573 }
574
575resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
576BIO_free(bio);
577if (!resp)
578 {
579 DEBUG(D_tls) debug_printf("Error reading OCSP response.\n");
580 return;
581 }
582
583status = OCSP_response_status(resp);
584if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL)
585 {
586 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
587 OCSP_response_status_str(status), status);
f5d78688 588 goto bad;
3f7eeb86
PP
589 }
590
591basic_response = OCSP_response_get1_basic(resp);
592if (!basic_response)
593 {
594 DEBUG(D_tls)
595 debug_printf("OCSP response parse error: unable to extract basic response.\n");
f5d78688 596 goto bad;
3f7eeb86
PP
597 }
598
599store = SSL_CTX_get_cert_store(sctx);
600verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
601
602/* May need to expose ability to adjust those flags?
603OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
604OCSP_TRUSTOTHER OCSP_NOINTERN */
605
606i = OCSP_basic_verify(basic_response, NULL, store, verify_flags);
607if (i <= 0)
608 {
609 DEBUG(D_tls) {
610 ERR_error_string(ERR_get_error(), ssl_errstring);
611 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
f5d78688
JH
612 }
613 goto bad;
3f7eeb86
PP
614 }
615
616/* Here's the simplifying assumption: there's only one response, for the
617one certificate we use, and nothing for anything else in a chain. If this
618proves false, we need to extract a cert id from our issued cert
619(tls_certificate) and use that for OCSP_resp_find_status() (which finds the
620right cert in the stack and then calls OCSP_single_get0_status()).
621
622I'm hoping to avoid reworking a bunch more of how we handle state here. */
623single_response = OCSP_resp_get0(basic_response, 0);
624if (!single_response)
625 {
626 DEBUG(D_tls)
627 debug_printf("Unable to get first response from OCSP basic response.\n");
f5d78688 628 goto bad;
3f7eeb86
PP
629 }
630
631status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
f5d78688 632if (status != V_OCSP_CERTSTATUS_GOOD)
3f7eeb86 633 {
f5d78688
JH
634 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
635 OCSP_cert_status_str(status), status,
636 OCSP_crl_reason_str(reason), reason);
637 goto bad;
3f7eeb86
PP
638 }
639
640if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
641 {
642 DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
f5d78688 643 goto bad;
3f7eeb86
PP
644 }
645
f5d78688 646supply_response:
018058b2 647 cbinfo->u_ocsp.server.response = resp;
f5d78688
JH
648return;
649
650bad:
018058b2
JH
651 if (running_in_test_harness)
652 {
653 extern char ** environ;
654 uschar ** p;
655 for (p = USS environ; *p != NULL; p++)
656 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
657 {
658 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
659 goto supply_response;
660 }
661 }
f5d78688 662return;
3f7eeb86 663}
f2de3a33 664#endif /*!DISABLE_OCSP*/
3f7eeb86
PP
665
666
667
668
059ec3d9 669/*************************************************
7be682ca
PP
670* Expand key and cert file specs *
671*************************************************/
672
f5d78688 673/* Called once during tls_init and possibly again during TLS setup, for a
7be682ca
PP
674new context, if Server Name Indication was used and tls_sni was seen in
675the certificate string.
676
677Arguments:
678 sctx the SSL_CTX* to update
679 cbinfo various parts of session state
680
681Returns: OK/DEFER/FAIL
682*/
683
684static int
3f7eeb86 685tls_expand_session_files(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo)
7be682ca
PP
686{
687uschar *expanded;
688
689if (cbinfo->certificate == NULL)
690 return OK;
691
d9b2312b
JH
692if (Ustrstr(cbinfo->certificate, US"tls_sni") ||
693 Ustrstr(cbinfo->certificate, US"tls_in_sni") ||
694 Ustrstr(cbinfo->certificate, US"tls_out_sni")
695 )
7be682ca
PP
696 reexpand_tls_files_for_sni = TRUE;
697
698if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded))
699 return DEFER;
700
701if (expanded != NULL)
702 {
703 DEBUG(D_tls) debug_printf("tls_certificate file %s\n", expanded);
704 if (!SSL_CTX_use_certificate_chain_file(sctx, CS expanded))
705 return tls_error(string_sprintf(
706 "SSL_CTX_use_certificate_chain_file file=%s", expanded),
707 cbinfo->host, NULL);
708 }
709
710if (cbinfo->privatekey != NULL &&
711 !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded))
712 return DEFER;
713
714/* If expansion was forced to fail, key_expanded will be NULL. If the result
715of the expansion is an empty string, ignore it also, and assume the private
716key is in the same file as the certificate. */
717
718if (expanded != NULL && *expanded != 0)
719 {
720 DEBUG(D_tls) debug_printf("tls_privatekey file %s\n", expanded);
721 if (!SSL_CTX_use_PrivateKey_file(sctx, CS expanded, SSL_FILETYPE_PEM))
722 return tls_error(string_sprintf(
723 "SSL_CTX_use_PrivateKey_file file=%s", expanded), cbinfo->host, NULL);
724 }
725
f2de3a33 726#ifndef DISABLE_OCSP
f5d78688 727if (cbinfo->is_server && cbinfo->u_ocsp.server.file != NULL)
3f7eeb86 728 {
f5d78688 729 if (!expand_check(cbinfo->u_ocsp.server.file, US"tls_ocsp_file", &expanded))
3f7eeb86
PP
730 return DEFER;
731
732 if (expanded != NULL && *expanded != 0)
733 {
734 DEBUG(D_tls) debug_printf("tls_ocsp_file %s\n", expanded);
f5d78688
JH
735 if (cbinfo->u_ocsp.server.file_expanded &&
736 (Ustrcmp(expanded, cbinfo->u_ocsp.server.file_expanded) == 0))
3f7eeb86
PP
737 {
738 DEBUG(D_tls)
739 debug_printf("tls_ocsp_file value unchanged, using existing values.\n");
740 } else {
741 ocsp_load_response(sctx, cbinfo, expanded);
742 }
743 }
744 }
745#endif
746
7be682ca
PP
747return OK;
748}
749
750
751
752
753/*************************************************
754* Callback to handle SNI *
755*************************************************/
756
757/* Called when acting as server during the TLS session setup if a Server Name
758Indication extension was sent by the client.
759
760API documentation is OpenSSL s_server.c implementation.
761
762Arguments:
763 s SSL* of the current session
764 ad unknown (part of OpenSSL API) (unused)
765 arg Callback of "our" registered data
766
767Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
768*/
769
3bcbbbe2 770#ifdef EXIM_HAVE_OPENSSL_TLSEXT
7be682ca 771static int
7be682ca
PP
772tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
773{
774const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
3f7eeb86 775tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
7be682ca 776int rc;
3f0945ff 777int old_pool = store_pool;
7be682ca
PP
778
779if (!servername)
780 return SSL_TLSEXT_ERR_OK;
781
3f0945ff 782DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
7be682ca
PP
783 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
784
785/* Make the extension value available for expansion */
3f0945ff 786store_pool = POOL_PERM;
817d9f57 787tls_in.sni = string_copy(US servername);
3f0945ff 788store_pool = old_pool;
7be682ca
PP
789
790if (!reexpand_tls_files_for_sni)
791 return SSL_TLSEXT_ERR_OK;
792
793/* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
794not confident that memcpy wouldn't break some internal reference counting.
795Especially since there's a references struct member, which would be off. */
796
0df4ab80 797if (!(server_sni = SSL_CTX_new(SSLv23_server_method())))
7be682ca
PP
798 {
799 ERR_error_string(ERR_get_error(), ssl_errstring);
800 DEBUG(D_tls) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring);
801 return SSL_TLSEXT_ERR_NOACK;
802 }
803
804/* Not sure how many of these are actually needed, since SSL object
805already exists. Might even need this selfsame callback, for reneg? */
806
817d9f57
JH
807SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(server_ctx));
808SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(server_ctx));
809SSL_CTX_set_options(server_sni, SSL_CTX_get_options(server_ctx));
810SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(server_ctx));
811SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
812SSL_CTX_set_tlsext_servername_arg(server_sni, cbinfo);
7be682ca 813if (cbinfo->server_cipher_list)
817d9f57 814 SSL_CTX_set_cipher_list(server_sni, CS cbinfo->server_cipher_list);
f2de3a33 815#ifndef DISABLE_OCSP
f5d78688 816if (cbinfo->u_ocsp.server.file)
3f7eeb86 817 {
f5d78688 818 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
14c7b357 819 SSL_CTX_set_tlsext_status_arg(server_sni, cbinfo);
3f7eeb86
PP
820 }
821#endif
7be682ca 822
983207c1 823rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE, verify_callback_server);
7be682ca
PP
824if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
825
3f7eeb86
PP
826/* do this after setup_certs, because this can require the certs for verifying
827OCSP information. */
817d9f57 828rc = tls_expand_session_files(server_sni, cbinfo);
7be682ca
PP
829if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
830
0df4ab80
JH
831if (!init_dh(server_sni, cbinfo->dhparam, NULL))
832 return SSL_TLSEXT_ERR_NOACK;
a799883d 833
7be682ca 834DEBUG(D_tls) debug_printf("Switching SSL context.\n");
817d9f57 835SSL_set_SSL_CTX(s, server_sni);
7be682ca
PP
836
837return SSL_TLSEXT_ERR_OK;
838}
3bcbbbe2 839#endif /* EXIM_HAVE_OPENSSL_TLSEXT */
7be682ca
PP
840
841
842
843
f2de3a33 844#ifndef DISABLE_OCSP
f5d78688 845
3f7eeb86
PP
846/*************************************************
847* Callback to handle OCSP Stapling *
848*************************************************/
849
850/* Called when acting as server during the TLS session setup if the client
851requests OCSP information with a Certificate Status Request.
852
853Documentation via openssl s_server.c and the Apache patch from the OpenSSL
854project.
855
856*/
857
858static int
f5d78688 859tls_server_stapling_cb(SSL *s, void *arg)
3f7eeb86
PP
860{
861const tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
862uschar *response_der;
863int response_der_len;
864
af4a1bca
JH
865DEBUG(D_tls)
866 debug_printf("Received TLS status request (OCSP stapling); %s response.",
f5d78688
JH
867 cbinfo->u_ocsp.server.response ? "have" : "lack");
868
44662487 869tls_in.ocsp = OCSP_NOT_RESP;
f5d78688 870if (!cbinfo->u_ocsp.server.response)
3f7eeb86
PP
871 return SSL_TLSEXT_ERR_NOACK;
872
873response_der = NULL;
44662487
JH
874response_der_len = i2d_OCSP_RESPONSE(cbinfo->u_ocsp.server.response,
875 &response_der);
3f7eeb86
PP
876if (response_der_len <= 0)
877 return SSL_TLSEXT_ERR_NOACK;
878
5e55c7a9 879SSL_set_tlsext_status_ocsp_resp(server_ssl, response_der, response_der_len);
44662487 880tls_in.ocsp = OCSP_VFIED;
3f7eeb86
PP
881return SSL_TLSEXT_ERR_OK;
882}
883
3f7eeb86 884
f5d78688
JH
885static void
886time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
887{
888BIO_printf(bp, "\t%s: ", str);
889ASN1_GENERALIZEDTIME_print(bp, time);
890BIO_puts(bp, "\n");
891}
892
893static int
894tls_client_stapling_cb(SSL *s, void *arg)
895{
896tls_ext_ctx_cb * cbinfo = arg;
897const unsigned char * p;
898int len;
899OCSP_RESPONSE * rsp;
900OCSP_BASICRESP * bs;
901int i;
902
903DEBUG(D_tls) debug_printf("Received TLS status response (OCSP stapling):");
904len = SSL_get_tlsext_status_ocsp_resp(s, &p);
905if(!p)
906 {
44662487
JH
907 /* Expect this when we requested ocsp but got none */
908 if ( cbinfo->u_ocsp.client.verify_required
909 && log_extra_selector & LX_tls_cipher)
910 log_write(0, LOG_MAIN, "Received TLS status callback, null content");
f5d78688
JH
911 else
912 DEBUG(D_tls) debug_printf(" null\n");
44662487 913 return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
f5d78688 914 }
018058b2 915
f5d78688
JH
916if(!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
917 {
018058b2 918 tls_out.ocsp = OCSP_FAILED;
f5d78688
JH
919 if (log_extra_selector & LX_tls_cipher)
920 log_write(0, LOG_MAIN, "Received TLS status response, parse error");
921 else
922 DEBUG(D_tls) debug_printf(" parse error\n");
923 return 0;
924 }
925
926if(!(bs = OCSP_response_get1_basic(rsp)))
927 {
018058b2 928 tls_out.ocsp = OCSP_FAILED;
f5d78688
JH
929 if (log_extra_selector & LX_tls_cipher)
930 log_write(0, LOG_MAIN, "Received TLS status response, error parsing response");
931 else
932 DEBUG(D_tls) debug_printf(" error parsing response\n");
933 OCSP_RESPONSE_free(rsp);
934 return 0;
935 }
936
937/* We'd check the nonce here if we'd put one in the request. */
938/* However that would defeat cacheability on the server so we don't. */
939
f5d78688
JH
940/* This section of code reworked from OpenSSL apps source;
941 The OpenSSL Project retains copyright:
942 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
943*/
944 {
945 BIO * bp = NULL;
f5d78688
JH
946 int status, reason;
947 ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
948
949 DEBUG(D_tls) bp = BIO_new_fp(stderr, BIO_NOCLOSE);
950
951 /*OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
952
953 /* Use the chain that verified the server cert to verify the stapled info */
954 /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
955
44662487
JH
956 if ((i = OCSP_basic_verify(bs, NULL,
957 cbinfo->u_ocsp.client.verify_store, 0)) <= 0)
f5d78688 958 {
018058b2 959 tls_out.ocsp = OCSP_FAILED;
f5d78688
JH
960 BIO_printf(bp, "OCSP response verify failure\n");
961 ERR_print_errors(bp);
44662487 962 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
f5d78688
JH
963 goto out;
964 }
965
966 BIO_printf(bp, "OCSP response well-formed and signed OK\n");
967
968 {
969 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
970 OCSP_SINGLERESP * single;
971
972 if (sk_OCSP_SINGLERESP_num(sresp) != 1)
973 {
018058b2 974 tls_out.ocsp = OCSP_FAILED;
44662487
JH
975 log_write(0, LOG_MAIN, "OCSP stapling "
976 "with multiple responses not handled");
977 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
f5d78688
JH
978 goto out;
979 }
980 single = OCSP_resp_get0(bs, 0);
44662487
JH
981 status = OCSP_single_get0_status(single, &reason, &rev,
982 &thisupd, &nextupd);
f5d78688
JH
983 }
984
f5d78688
JH
985 DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
986 DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
44662487
JH
987 if (!OCSP_check_validity(thisupd, nextupd,
988 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
f5d78688 989 {
018058b2 990 tls_out.ocsp = OCSP_FAILED;
f5d78688
JH
991 DEBUG(D_tls) ERR_print_errors(bp);
992 log_write(0, LOG_MAIN, "Server OSCP dates invalid");
44662487 993 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
f5d78688 994 }
44662487 995 else
f5d78688 996 {
44662487
JH
997 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
998 OCSP_cert_status_str(status));
999 switch(status)
1000 {
1001 case V_OCSP_CERTSTATUS_GOOD:
44662487 1002 tls_out.ocsp = OCSP_VFIED;
018058b2 1003 i = 1;
44662487
JH
1004 break;
1005 case V_OCSP_CERTSTATUS_REVOKED:
018058b2 1006 tls_out.ocsp = OCSP_FAILED;
44662487
JH
1007 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
1008 reason != -1 ? "; reason: " : "",
1009 reason != -1 ? OCSP_crl_reason_str(reason) : "");
1010 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
1011 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1012 break;
1013 default:
018058b2 1014 tls_out.ocsp = OCSP_FAILED;
44662487
JH
1015 log_write(0, LOG_MAIN,
1016 "Server certificate status unknown, in OCSP stapling");
1017 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1018 break;
1019 }
f5d78688
JH
1020 }
1021 out:
1022 BIO_free(bp);
1023 }
1024
1025OCSP_RESPONSE_free(rsp);
1026return i;
1027}
f2de3a33 1028#endif /*!DISABLE_OCSP*/
3f7eeb86
PP
1029
1030
7be682ca 1031/*************************************************
059ec3d9
PH
1032* Initialize for TLS *
1033*************************************************/
1034
e51c7be2
JH
1035/* Called from both server and client code, to do preliminary initialization
1036of the library. We allocate and return a context structure.
059ec3d9
PH
1037
1038Arguments:
946ecbe0 1039 ctxp returned SSL context
059ec3d9
PH
1040 host connected host, if client; NULL if server
1041 dhparam DH parameter file
1042 certificate certificate file
1043 privatekey private key
f5d78688 1044 ocsp_file file of stapling info (server); flag for require ocsp (client)
059ec3d9 1045 addr address if client; NULL if server (for some randomness)
946ecbe0 1046 cbp place to put allocated callback context
059ec3d9
PH
1047
1048Returns: OK/DEFER/FAIL
1049*/
1050
1051static int
817d9f57 1052tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate,
3f7eeb86 1053 uschar *privatekey,
f2de3a33 1054#ifndef DISABLE_OCSP
3f7eeb86
PP
1055 uschar *ocsp_file,
1056#endif
817d9f57 1057 address_item *addr, tls_ext_ctx_cb ** cbp)
059ec3d9 1058{
77bb000f 1059long init_options;
7be682ca 1060int rc;
77bb000f 1061BOOL okay;
7be682ca
PP
1062tls_ext_ctx_cb *cbinfo;
1063
1064cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
1065cbinfo->certificate = certificate;
1066cbinfo->privatekey = privatekey;
f2de3a33 1067#ifndef DISABLE_OCSP
f5d78688
JH
1068if ((cbinfo->is_server = host==NULL))
1069 {
1070 cbinfo->u_ocsp.server.file = ocsp_file;
1071 cbinfo->u_ocsp.server.file_expanded = NULL;
1072 cbinfo->u_ocsp.server.response = NULL;
1073 }
1074else
1075 cbinfo->u_ocsp.client.verify_store = NULL;
3f7eeb86 1076#endif
7be682ca 1077cbinfo->dhparam = dhparam;
0df4ab80 1078cbinfo->server_cipher_list = NULL;
7be682ca 1079cbinfo->host = host;
77bb000f 1080
059ec3d9
PH
1081SSL_load_error_strings(); /* basic set up */
1082OpenSSL_add_ssl_algorithms();
1083
388d6564 1084#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
77bb000f 1085/* SHA256 is becoming ever more popular. This makes sure it gets added to the
a0475b69
TK
1086list of available digests. */
1087EVP_add_digest(EVP_sha256());
cf1ef1a9 1088#endif
a0475b69 1089
f0f5a555
PP
1090/* Create a context.
1091The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
1092negotiation in the different methods; as far as I can tell, the only
1093*_{server,client}_method which allows negotiation is SSLv23, which exists even
1094when OpenSSL is built without SSLv2 support.
1095By disabling with openssl_options, we can let admins re-enable with the
1096existing knob. */
059ec3d9 1097
817d9f57 1098*ctxp = SSL_CTX_new((host == NULL)?
059ec3d9
PH
1099 SSLv23_server_method() : SSLv23_client_method());
1100
817d9f57 1101if (*ctxp == NULL) return tls_error(US"SSL_CTX_new", host, NULL);
059ec3d9
PH
1102
1103/* It turns out that we need to seed the random number generator this early in
1104order to get the full complement of ciphers to work. It took me roughly a day
1105of work to discover this by experiment.
1106
1107On systems that have /dev/urandom, SSL may automatically seed itself from
1108there. Otherwise, we have to make something up as best we can. Double check
1109afterwards. */
1110
1111if (!RAND_status())
1112 {
1113 randstuff r;
9e3331ea 1114 gettimeofday(&r.tv, NULL);
059ec3d9
PH
1115 r.p = getpid();
1116
1117 RAND_seed((uschar *)(&r), sizeof(r));
1118 RAND_seed((uschar *)big_buffer, big_buffer_size);
1119 if (addr != NULL) RAND_seed((uschar *)addr, sizeof(addr));
1120
1121 if (!RAND_status())
7199e1ee 1122 return tls_error(US"RAND_status", host,
5ca6d115 1123 US"unable to seed random number generator");
059ec3d9
PH
1124 }
1125
1126/* Set up the information callback, which outputs if debugging is at a suitable
1127level. */
1128
817d9f57 1129SSL_CTX_set_info_callback(*ctxp, (void (*)())info_callback);
059ec3d9 1130
c80c5570 1131/* Automatically re-try reads/writes after renegotiation. */
817d9f57 1132(void) SSL_CTX_set_mode(*ctxp, SSL_MODE_AUTO_RETRY);
c80c5570 1133
77bb000f
PP
1134/* Apply administrator-supplied work-arounds.
1135Historically we applied just one requested option,
1136SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
1137moved to an administrator-controlled list of options to specify and
1138grandfathered in the first one as the default value for "openssl_options".
059ec3d9 1139
77bb000f
PP
1140No OpenSSL version number checks: the options we accept depend upon the
1141availability of the option value macros from OpenSSL. */
059ec3d9 1142
77bb000f
PP
1143okay = tls_openssl_options_parse(openssl_options, &init_options);
1144if (!okay)
73a46702 1145 return tls_error(US"openssl_options parsing failed", host, NULL);
77bb000f
PP
1146
1147if (init_options)
1148 {
1149 DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
817d9f57 1150 if (!(SSL_CTX_set_options(*ctxp, init_options)))
77bb000f
PP
1151 return tls_error(string_sprintf(
1152 "SSL_CTX_set_option(%#lx)", init_options), host, NULL);
1153 }
1154else
1155 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
059ec3d9
PH
1156
1157/* Initialize with DH parameters if supplied */
1158
817d9f57 1159if (!init_dh(*ctxp, dhparam, host)) return DEFER;
059ec3d9 1160
3f7eeb86 1161/* Set up certificate and key (and perhaps OCSP info) */
059ec3d9 1162
817d9f57 1163rc = tls_expand_session_files(*ctxp, cbinfo);
7be682ca 1164if (rc != OK) return rc;
c91535f3 1165
7be682ca 1166/* If we need to handle SNI, do so */
3bcbbbe2 1167#ifdef EXIM_HAVE_OPENSSL_TLSEXT
f5d78688 1168if (host == NULL) /* server */
3f0945ff 1169 {
f2de3a33 1170# ifndef DISABLE_OCSP
f5d78688 1171 /* We check u_ocsp.server.file, not server.response, because we care about if
3f7eeb86
PP
1172 the option exists, not what the current expansion might be, as SNI might
1173 change the certificate and OCSP file in use between now and the time the
1174 callback is invoked. */
f5d78688 1175 if (cbinfo->u_ocsp.server.file)
3f7eeb86 1176 {
f5d78688 1177 SSL_CTX_set_tlsext_status_cb(server_ctx, tls_server_stapling_cb);
5e55c7a9 1178 SSL_CTX_set_tlsext_status_arg(server_ctx, cbinfo);
3f7eeb86 1179 }
f5d78688 1180# endif
3f0945ff
PP
1181 /* We always do this, so that $tls_sni is available even if not used in
1182 tls_certificate */
817d9f57
JH
1183 SSL_CTX_set_tlsext_servername_callback(*ctxp, tls_servername_cb);
1184 SSL_CTX_set_tlsext_servername_arg(*ctxp, cbinfo);
3f0945ff 1185 }
f2de3a33 1186# ifndef DISABLE_OCSP
f5d78688
JH
1187else /* client */
1188 if(ocsp_file) /* wanting stapling */
1189 {
1190 if (!(cbinfo->u_ocsp.client.verify_store = X509_STORE_new()))
1191 {
1192 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
1193 return FAIL;
1194 }
1195 SSL_CTX_set_tlsext_status_cb(*ctxp, tls_client_stapling_cb);
1196 SSL_CTX_set_tlsext_status_arg(*ctxp, cbinfo);
1197 }
1198# endif
7be682ca 1199#endif
059ec3d9 1200
e51c7be2
JH
1201#ifdef EXPERIMENTAL_CERTNAMES
1202cbinfo->verify_cert_hostnames = NULL;
1203#endif
1204
059ec3d9
PH
1205/* Set up the RSA callback */
1206
817d9f57 1207SSL_CTX_set_tmp_rsa_callback(*ctxp, rsa_callback);
059ec3d9
PH
1208
1209/* Finally, set the timeout, and we are done */
1210
817d9f57 1211SSL_CTX_set_timeout(*ctxp, ssl_session_timeout);
059ec3d9 1212DEBUG(D_tls) debug_printf("Initialized TLS\n");
7be682ca 1213
817d9f57 1214*cbp = cbinfo;
7be682ca 1215
059ec3d9
PH
1216return OK;
1217}
1218
1219
1220
1221
1222/*************************************************
1223* Get name of cipher in use *
1224*************************************************/
1225
817d9f57 1226/*
059ec3d9 1227Argument: pointer to an SSL structure for the connection
817d9f57
JH
1228 buffer to use for answer
1229 size of buffer
1230 pointer to number of bits for cipher
059ec3d9
PH
1231Returns: nothing
1232*/
1233
1234static void
817d9f57 1235construct_cipher_name(SSL *ssl, uschar *cipherbuf, int bsize, int *bits)
059ec3d9 1236{
57b3a7f5
PP
1237/* With OpenSSL 1.0.0a, this needs to be const but the documentation doesn't
1238yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
1239the accessor functions use const in the prototype. */
1240const SSL_CIPHER *c;
d9784128 1241const uschar *ver;
059ec3d9 1242
d9784128 1243ver = (const uschar *)SSL_get_version(ssl);
059ec3d9 1244
57b3a7f5 1245c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
817d9f57 1246SSL_CIPHER_get_bits(c, bits);
059ec3d9 1247
817d9f57
JH
1248string_format(cipherbuf, bsize, "%s:%s:%u", ver,
1249 SSL_CIPHER_get_name(c), *bits);
059ec3d9
PH
1250
1251DEBUG(D_tls) debug_printf("Cipher: %s\n", cipherbuf);
1252}
1253
1254
1255
1256
1257
1258/*************************************************
1259* Set up for verifying certificates *
1260*************************************************/
1261
1262/* Called by both client and server startup
1263
1264Arguments:
7be682ca 1265 sctx SSL_CTX* to initialise
059ec3d9
PH
1266 certs certs file or NULL
1267 crl CRL file or NULL
1268 host NULL in a server; the remote host in a client
1269 optional TRUE if called from a server for a host in tls_try_verify_hosts;
1270 otherwise passed as FALSE
983207c1 1271 cert_vfy_cb Callback function for certificate verification
059ec3d9
PH
1272
1273Returns: OK/DEFER/FAIL
1274*/
1275
1276static int
983207c1
JH
1277setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
1278 int (*cert_vfy_cb)(int, X509_STORE_CTX *) )
059ec3d9
PH
1279{
1280uschar *expcerts, *expcrl;
1281
1282if (!expand_check(certs, US"tls_verify_certificates", &expcerts))
1283 return DEFER;
1284
26e72755 1285if (expcerts != NULL && *expcerts != '\0')
059ec3d9
PH
1286 {
1287 struct stat statbuf;
7be682ca 1288 if (!SSL_CTX_set_default_verify_paths(sctx))
7199e1ee 1289 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL);
059ec3d9
PH
1290
1291 if (Ustat(expcerts, &statbuf) < 0)
1292 {
1293 log_write(0, LOG_MAIN|LOG_PANIC,
1294 "failed to stat %s for certificates", expcerts);
1295 return DEFER;
1296 }
1297 else
1298 {
1299 uschar *file, *dir;
1300 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1301 { file = NULL; dir = expcerts; }
1302 else
1303 { file = expcerts; dir = NULL; }
1304
1305 /* If a certificate file is empty, the next function fails with an
1306 unhelpful error message. If we skip it, we get the correct behaviour (no
1307 certificates are recognized, but the error message is still misleading (it
1308 says no certificate was supplied.) But this is better. */
1309
1310 if ((file == NULL || statbuf.st_size > 0) &&
7be682ca 1311 !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
7199e1ee 1312 return tls_error(US"SSL_CTX_load_verify_locations", host, NULL);
059ec3d9
PH
1313
1314 if (file != NULL)
1315 {
7be682ca 1316 SSL_CTX_set_client_CA_list(sctx, SSL_load_client_CA_file(CS file));
059ec3d9
PH
1317 }
1318 }
1319
1320 /* Handle a certificate revocation list. */
1321
1322 #if OPENSSL_VERSION_NUMBER > 0x00907000L
1323
8b417f2c
PH
1324 /* This bit of code is now the version supplied by Lars Mainka. (I have
1325 * merely reformatted it into the Exim code style.)
1326
1327 * "From here I changed the code to add support for multiple crl's
1328 * in pem format in one file or to support hashed directory entries in
1329 * pem format instead of a file. This method now uses the library function
1330 * X509_STORE_load_locations to add the CRL location to the SSL context.
1331 * OpenSSL will then handle the verify against CA certs and CRLs by
1332 * itself in the verify callback." */
1333
059ec3d9
PH
1334 if (!expand_check(crl, US"tls_crl", &expcrl)) return DEFER;
1335 if (expcrl != NULL && *expcrl != 0)
1336 {
8b417f2c
PH
1337 struct stat statbufcrl;
1338 if (Ustat(expcrl, &statbufcrl) < 0)
1339 {
1340 log_write(0, LOG_MAIN|LOG_PANIC,
1341 "failed to stat %s for certificates revocation lists", expcrl);
1342 return DEFER;
1343 }
1344 else
059ec3d9 1345 {
8b417f2c
PH
1346 /* is it a file or directory? */
1347 uschar *file, *dir;
7be682ca 1348 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
8b417f2c 1349 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
059ec3d9 1350 {
8b417f2c
PH
1351 file = NULL;
1352 dir = expcrl;
1353 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
059ec3d9
PH
1354 }
1355 else
1356 {
8b417f2c
PH
1357 file = expcrl;
1358 dir = NULL;
1359 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
059ec3d9 1360 }
8b417f2c 1361 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
7199e1ee 1362 return tls_error(US"X509_STORE_load_locations", host, NULL);
8b417f2c
PH
1363
1364 /* setting the flags to check against the complete crl chain */
1365
1366 X509_STORE_set_flags(cvstore,
1367 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
059ec3d9 1368 }
059ec3d9
PH
1369 }
1370
1371 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
1372
1373 /* If verification is optional, don't fail if no certificate */
1374
7be682ca 1375 SSL_CTX_set_verify(sctx,
059ec3d9 1376 SSL_VERIFY_PEER | (optional? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
983207c1 1377 cert_vfy_cb);
059ec3d9
PH
1378 }
1379
1380return OK;
1381}
1382
1383
1384
1385/*************************************************
1386* Start a TLS session in a server *
1387*************************************************/
1388
1389/* This is called when Exim is running as a server, after having received
1390the STARTTLS command. It must respond to that command, and then negotiate
1391a TLS session.
1392
1393Arguments:
1394 require_ciphers allowed ciphers
1395
1396Returns: OK on success
1397 DEFER for errors before the start of the negotiation
1398 FAIL for errors during the negotation; the server can't
1399 continue running.
1400*/
1401
1402int
17c76198 1403tls_server_start(const uschar *require_ciphers)
059ec3d9
PH
1404{
1405int rc;
1406uschar *expciphers;
7be682ca 1407tls_ext_ctx_cb *cbinfo;
817d9f57 1408static uschar cipherbuf[256];
059ec3d9
PH
1409
1410/* Check for previous activation */
1411
817d9f57 1412if (tls_in.active >= 0)
059ec3d9 1413 {
5ca6d115 1414 tls_error(US"STARTTLS received after TLS started", NULL, US"");
059ec3d9
PH
1415 smtp_printf("554 Already in TLS\r\n");
1416 return FAIL;
1417 }
1418
1419/* Initialize the SSL library. If it fails, it will already have logged
1420the error. */
1421
817d9f57 1422rc = tls_init(&server_ctx, NULL, tls_dhparam, tls_certificate, tls_privatekey,
f2de3a33 1423#ifndef DISABLE_OCSP
3f7eeb86
PP
1424 tls_ocsp_file,
1425#endif
817d9f57 1426 NULL, &server_static_cbinfo);
059ec3d9 1427if (rc != OK) return rc;
817d9f57 1428cbinfo = server_static_cbinfo;
059ec3d9
PH
1429
1430if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers))
1431 return FAIL;
1432
1433/* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
17c76198
PP
1434were historically separated by underscores. So that I can use either form in my
1435tests, and also for general convenience, we turn underscores into hyphens here.
1436*/
059ec3d9
PH
1437
1438if (expciphers != NULL)
1439 {
1440 uschar *s = expciphers;
1441 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1442 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
817d9f57 1443 if (!SSL_CTX_set_cipher_list(server_ctx, CS expciphers))
7199e1ee 1444 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL);
7be682ca 1445 cbinfo->server_cipher_list = expciphers;
059ec3d9
PH
1446 }
1447
1448/* If this is a host for which certificate verification is mandatory or
1449optional, set up appropriately. */
1450
817d9f57 1451tls_in.certificate_verified = FALSE;
53a7196b
JH
1452#ifdef EXPERIMENTAL_DANE
1453tls_in.dane_verified = FALSE;
1454#endif
a2ff477a 1455server_verify_callback_called = FALSE;
059ec3d9
PH
1456
1457if (verify_check_host(&tls_verify_hosts) == OK)
1458 {
983207c1
JH
1459 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1460 FALSE, verify_callback_server);
059ec3d9 1461 if (rc != OK) return rc;
a2ff477a 1462 server_verify_optional = FALSE;
059ec3d9
PH
1463 }
1464else if (verify_check_host(&tls_try_verify_hosts) == OK)
1465 {
983207c1
JH
1466 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1467 TRUE, verify_callback_server);
059ec3d9 1468 if (rc != OK) return rc;
a2ff477a 1469 server_verify_optional = TRUE;
059ec3d9
PH
1470 }
1471
1472/* Prepare for new connection */
1473
817d9f57 1474if ((server_ssl = SSL_new(server_ctx)) == NULL) return tls_error(US"SSL_new", NULL, NULL);
da3ad30d
PP
1475
1476/* Warning: we used to SSL_clear(ssl) here, it was removed.
1477 *
1478 * With the SSL_clear(), we get strange interoperability bugs with
1479 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
1480 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
1481 *
1482 * The SSL_clear() call is to let an existing SSL* be reused, typically after
1483 * session shutdown. In this case, we have a brand new object and there's no
1484 * obvious reason to immediately clear it. I'm guessing that this was
1485 * originally added because of incomplete initialisation which the clear fixed,
1486 * in some historic release.
1487 */
059ec3d9
PH
1488
1489/* Set context and tell client to go ahead, except in the case of TLS startup
1490on connection, where outputting anything now upsets the clients and tends to
1491make them disconnect. We need to have an explicit fflush() here, to force out
1492the response. Other smtp_printf() calls do not need it, because in non-TLS
1493mode, the fflush() happens when smtp_getc() is called. */
1494
817d9f57
JH
1495SSL_set_session_id_context(server_ssl, sid_ctx, Ustrlen(sid_ctx));
1496if (!tls_in.on_connect)
059ec3d9
PH
1497 {
1498 smtp_printf("220 TLS go ahead\r\n");
1499 fflush(smtp_out);
1500 }
1501
1502/* Now negotiate the TLS session. We put our own timer on it, since it seems
1503that the OpenSSL library doesn't. */
1504
817d9f57
JH
1505SSL_set_wfd(server_ssl, fileno(smtp_out));
1506SSL_set_rfd(server_ssl, fileno(smtp_in));
1507SSL_set_accept_state(server_ssl);
059ec3d9
PH
1508
1509DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
1510
1511sigalrm_seen = FALSE;
1512if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
817d9f57 1513rc = SSL_accept(server_ssl);
059ec3d9
PH
1514alarm(0);
1515
1516if (rc <= 0)
1517 {
7199e1ee 1518 tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL);
77bb000f
PP
1519 if (ERR_get_error() == 0)
1520 log_write(0, LOG_MAIN,
a053d125 1521 "TLS client disconnected cleanly (rejected our certificate?)");
059ec3d9
PH
1522 return FAIL;
1523 }
1524
1525DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
1526
1527/* TLS has been set up. Adjust the input functions to read via TLS,
1528and initialize things. */
1529
817d9f57
JH
1530construct_cipher_name(server_ssl, cipherbuf, sizeof(cipherbuf), &tls_in.bits);
1531tls_in.cipher = cipherbuf;
059ec3d9
PH
1532
1533DEBUG(D_tls)
1534 {
1535 uschar buf[2048];
817d9f57 1536 if (SSL_get_shared_ciphers(server_ssl, CS buf, sizeof(buf)) != NULL)
059ec3d9
PH
1537 debug_printf("Shared ciphers: %s\n", buf);
1538 }
1539
9d1c15ef
JH
1540/* Record the certificate we presented */
1541 {
1542 X509 * crt = SSL_get_certificate(server_ssl);
1543 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
1544 }
059ec3d9 1545
817d9f57
JH
1546/* Only used by the server-side tls (tls_in), including tls_getc.
1547 Client-side (tls_out) reads (seem to?) go via
1548 smtp_read_response()/ip_recv().
1549 Hence no need to duplicate for _in and _out.
1550 */
059ec3d9
PH
1551ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1552ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
1553ssl_xfer_eof = ssl_xfer_error = 0;
1554
1555receive_getc = tls_getc;
1556receive_ungetc = tls_ungetc;
1557receive_feof = tls_feof;
1558receive_ferror = tls_ferror;
58eb016e 1559receive_smtp_buffered = tls_smtp_buffered;
059ec3d9 1560
817d9f57 1561tls_in.active = fileno(smtp_out);
059ec3d9
PH
1562return OK;
1563}
1564
1565
1566
1567
043b1248
JH
1568static int
1569tls_client_basic_ctx_init(SSL_CTX * ctx,
1570 host_item * host, smtp_transport_options_block * ob
1571#ifdef EXPERIMENTAL_CERTNAMES
1572 , tls_ext_ctx_cb * cbinfo
1573#endif
1574 )
1575{
1576int rc;
1577/* stick to the old behaviour for compatibility if tls_verify_certificates is
1578 set but both tls_verify_hosts and tls_try_verify_hosts is not set. Check only
1579 the specified host patterns if one of them is defined */
1580
1581if ((!ob->tls_verify_hosts && !ob->tls_try_verify_hosts) ||
1582 (verify_check_host(&ob->tls_verify_hosts) == OK))
1583 {
1584 if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
1585 ob->tls_crl, host, FALSE, verify_callback_client)) != OK)
1586 return rc;
1587 client_verify_optional = FALSE;
1588
1589#ifdef EXPERIMENTAL_CERTNAMES
1590 if (ob->tls_verify_cert_hostnames)
1591 {
1592 if (!expand_check(ob->tls_verify_cert_hostnames,
1593 US"tls_verify_cert_hostnames",
1594 &cbinfo->verify_cert_hostnames))
1595 return FAIL;
1596 if (cbinfo->verify_cert_hostnames)
1597 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
1598 cbinfo->verify_cert_hostnames);
1599 }
1600#endif
1601 }
1602else if (verify_check_host(&ob->tls_try_verify_hosts) == OK)
1603 {
1604 if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
1605 ob->tls_crl, host, TRUE, verify_callback_client)) != OK)
1606 return rc;
1607 client_verify_optional = TRUE;
1608 }
1609
1610return OK;
1611}
059ec3d9 1612
fde080a4
JH
1613
1614#ifdef EXPERIMENTAL_DANE
1615static int
1616tlsa_lookup(host_item * host, dns_answer * dnsa,
1617 BOOL dane_required, BOOL * dane)
1618{
1619/* move this out to host.c given the similarity to dns_lookup() ? */
1620uschar buffer[300];
1621uschar * fullname = buffer;
1622
1623/* TLSA lookup string */
1624(void)sprintf(CS buffer, "_%d._tcp.%.256s", host->port, host->name);
1625
1626switch (dns_lookup(dnsa, buffer, T_TLSA, &fullname))
1627 {
1628 case DNS_AGAIN:
1629 return DEFER; /* just defer this TLS'd conn */
1630
1631 default:
1632 case DNS_FAIL:
1633 if (dane_required)
1634 {
1635 log_write(0, LOG_MAIN, "DANE error: TLSA lookup failed");
1636 return FAIL;
1637 }
1638 break;
1639
1640 case DNS_SUCCEED:
1641 if (!dns_is_secure(dnsa))
1642 {
1643 log_write(0, LOG_MAIN, "DANE error: TLSA lookup not DNSSEC");
1644 return DEFER;
1645 }
1646 *dane = TRUE;
1647 break;
1648 }
1649return OK;
1650}
1651
1652
1653static int
1654dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa)
1655{
1656dns_record * rr;
1657dns_scan dnss;
1658const char * hostnames[2] = { CS host->name, NULL };
1659int found = 0;
1660
1661if (DANESSL_init(ssl, NULL, hostnames) != 1)
1662 return tls_error(US"hostnames load", host, NULL);
1663
1664for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
1665 rr;
1666 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
1667 ) if (rr->type == T_TLSA)
1668 {
1669 uschar * p = rr->data;
1670 uint8_t usage, selector, mtype;
1671 const char * mdname;
1672
1673 found++;
1674 usage = *p++;
1675 selector = *p++;
1676 mtype = *p++;
1677
1678 switch (mtype)
1679 {
1680 default:
1681 log_write(0, LOG_MAIN,
1682 "DANE error: TLSA record w/bad mtype 0x%x", mtype);
1683 return FAIL;
1684 case 0: mdname = NULL; break;
1685 case 1: mdname = "sha256"; break;
1686 case 2: mdname = "sha512"; break;
1687 }
1688
1689 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
1690 {
1691 default:
1692 case 0: /* action not taken */
1693 return tls_error(US"tlsa load", host, NULL);
1694 case 1: break;
1695 }
1696 }
1697
1698if (found)
1699 return OK;
1700
1701log_write(0, LOG_MAIN, "DANE error: No TLSA records");
1702return FAIL;
1703}
1704#endif /*EXPERIMENTAL_DANE*/
1705
1706
1707
059ec3d9
PH
1708/*************************************************
1709* Start a TLS session in a client *
1710*************************************************/
1711
1712/* Called from the smtp transport after STARTTLS has been accepted.
1713
1714Argument:
1715 fd the fd of the connection
1716 host connected host (for messages)
83da1223 1717 addr the first address
65867078 1718 ob smtp transport options
059ec3d9
PH
1719
1720Returns: OK on success
1721 FAIL otherwise - note that tls_error() will not give DEFER
1722 because this is not a server
1723*/
1724
1725int
f5d78688 1726tls_client_start(int fd, host_item *host, address_item *addr,
65867078 1727 void *v_ob)
059ec3d9 1728{
65867078 1729smtp_transport_options_block * ob = v_ob;
059ec3d9 1730static uschar txt[256];
868f5672
JH
1731uschar * expciphers;
1732X509 * server_cert;
059ec3d9 1733int rc;
817d9f57 1734static uschar cipherbuf[256];
043b1248
JH
1735
1736#ifndef DISABLE_OCSP
043b1248 1737BOOL request_ocsp = FALSE;
6634ac8d 1738BOOL require_ocsp = FALSE;
043b1248
JH
1739#endif
1740#ifdef EXPERIMENTAL_DANE
868f5672
JH
1741dns_answer tlsa_dnsa;
1742BOOL dane = FALSE;
1743BOOL dane_required;
043b1248
JH
1744#endif
1745
1746#ifdef EXPERIMENTAL_DANE
fde080a4 1747tls_out.dane_verified = FALSE;
868f5672
JH
1748dane_required = verify_check_this_host(&ob->hosts_require_dane, NULL,
1749 host->name, host->address, NULL) == OK;
868f5672
JH
1750
1751if (host->dnssec == DS_YES)
1752 {
1753 if( dane_required
1754 || verify_check_this_host(&ob->hosts_try_dane, NULL,
1755 host->name, host->address, NULL) == OK
1756 )
fde080a4
JH
1757 if ((rc = tlsa_lookup(host, &tlsa_dnsa, dane_required, &dane)) != OK)
1758 return rc;
868f5672 1759 }
7a31d643 1760else if (dane_required)
868f5672 1761 {
cf2b569e 1762 /*XXX a shame we only find this after making tcp & smtp connection */
b4161d10 1763 /* move the test earlier? */
7a31d643 1764 log_write(0, LOG_MAIN, "DANE error: previous lookup not DNSSEC");
868f5672
JH
1765 return FAIL;
1766 }
043b1248 1767
043b1248
JH
1768#endif
1769
f2de3a33 1770#ifndef DISABLE_OCSP
043b1248
JH
1771 {
1772 require_ocsp = verify_check_this_host(&ob->hosts_require_ocsp,
1773 NULL, host->name, host->address, NULL) == OK;
1774 request_ocsp = require_ocsp ? TRUE
1775 : verify_check_this_host(&ob->hosts_request_ocsp,
1776 NULL, host->name, host->address, NULL) == OK;
1777 }
f5d78688 1778#endif
059ec3d9 1779
65867078
JH
1780rc = tls_init(&client_ctx, host, NULL,
1781 ob->tls_certificate, ob->tls_privatekey,
f2de3a33 1782#ifndef DISABLE_OCSP
44662487 1783 (void *)(long)request_ocsp,
3f7eeb86 1784#endif
817d9f57 1785 addr, &client_static_cbinfo);
059ec3d9
PH
1786if (rc != OK) return rc;
1787
817d9f57 1788tls_out.certificate_verified = FALSE;
a2ff477a 1789client_verify_callback_called = FALSE;
059ec3d9 1790
65867078
JH
1791if (!expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
1792 &expciphers))
059ec3d9
PH
1793 return FAIL;
1794
1795/* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
1796are separated by underscores. So that I can use either form in my tests, and
1797also for general convenience, we turn underscores into hyphens here. */
1798
1799if (expciphers != NULL)
1800 {
1801 uschar *s = expciphers;
1802 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1803 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
817d9f57 1804 if (!SSL_CTX_set_cipher_list(client_ctx, CS expciphers))
7199e1ee 1805 return tls_error(US"SSL_CTX_set_cipher_list", host, NULL);
059ec3d9
PH
1806 }
1807
043b1248 1808#ifdef EXPERIMENTAL_DANE
868f5672 1809if (dane)
a63be306 1810 {
e5cccda9
JH
1811 SSL_CTX_set_verify(client_ctx, SSL_VERIFY_PEER, verify_callback_client_dane);
1812
043b1248 1813 if (!DANESSL_library_init())
b4161d10 1814 return tls_error(US"library init", host, NULL);
043b1248 1815 if (DANESSL_CTX_init(client_ctx) <= 0)
b4161d10 1816 return tls_error(US"context init", host, NULL);
043b1248
JH
1817 }
1818else
e51c7be2 1819
043b1248
JH
1820#endif
1821
1822 if ((rc = tls_client_basic_ctx_init(client_ctx, host, ob
e51c7be2 1823#ifdef EXPERIMENTAL_CERTNAMES
043b1248 1824 , client_static_cbinfo
e51c7be2 1825#endif
043b1248 1826 )) != OK)
65867078 1827 return rc;
059ec3d9 1828
65867078
JH
1829if ((client_ssl = SSL_new(client_ctx)) == NULL)
1830 return tls_error(US"SSL_new", host, NULL);
817d9f57
JH
1831SSL_set_session_id_context(client_ssl, sid_ctx, Ustrlen(sid_ctx));
1832SSL_set_fd(client_ssl, fd);
1833SSL_set_connect_state(client_ssl);
059ec3d9 1834
65867078 1835if (ob->tls_sni)
3f0945ff 1836 {
65867078 1837 if (!expand_check(ob->tls_sni, US"tls_sni", &tls_out.sni))
3f0945ff 1838 return FAIL;
ec4b68e5 1839 if (tls_out.sni == NULL)
2c9a0e86
PP
1840 {
1841 DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
1842 }
ec4b68e5 1843 else if (!Ustrlen(tls_out.sni))
817d9f57 1844 tls_out.sni = NULL;
3f0945ff
PP
1845 else
1846 {
35731706 1847#ifdef EXIM_HAVE_OPENSSL_TLSEXT
817d9f57
JH
1848 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tls_out.sni);
1849 SSL_set_tlsext_host_name(client_ssl, tls_out.sni);
35731706
PP
1850#else
1851 DEBUG(D_tls)
1852 debug_printf("OpenSSL at build-time lacked SNI support, ignoring \"%s\"\n",
02d9264f 1853 tls_out.sni);
35731706 1854#endif
3f0945ff
PP
1855 }
1856 }
1857
f2de3a33 1858#ifndef DISABLE_OCSP
f5d78688
JH
1859/* Request certificate status at connection-time. If the server
1860does OCSP stapling we will get the callback (set in tls_init()) */
44662487
JH
1861if (request_ocsp)
1862 {
f5d78688 1863 SSL_set_tlsext_status_type(client_ssl, TLSEXT_STATUSTYPE_ocsp);
44662487
JH
1864 client_static_cbinfo->u_ocsp.client.verify_required = require_ocsp;
1865 tls_out.ocsp = OCSP_NOT_RESP;
1866 }
f5d78688
JH
1867#endif
1868
043b1248 1869#ifdef EXPERIMENTAL_DANE
868f5672 1870if (dane)
fde080a4
JH
1871 if ((rc = dane_tlsa_load(client_ssl, host, &tlsa_dnsa)) != OK)
1872 return rc;
043b1248
JH
1873#endif
1874
1875
059ec3d9
PH
1876/* There doesn't seem to be a built-in timeout on connection. */
1877
1878DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
1879sigalrm_seen = FALSE;
65867078 1880alarm(ob->command_timeout);
817d9f57 1881rc = SSL_connect(client_ssl);
059ec3d9
PH
1882alarm(0);
1883
043b1248 1884#ifdef EXPERIMENTAL_DANE
12ee8cf9 1885if (dane)
fde080a4 1886 DANESSL_cleanup(client_ssl);
043b1248
JH
1887#endif
1888
059ec3d9 1889if (rc <= 0)
7199e1ee 1890 return tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL);
059ec3d9
PH
1891
1892DEBUG(D_tls) debug_printf("SSL_connect succeeded\n");
1893
453a6645 1894/* Beware anonymous ciphers which lead to server_cert being NULL */
9d1c15ef 1895/*XXX server_cert is never freed... use X509_free() */
817d9f57 1896server_cert = SSL_get_peer_certificate (client_ssl);
453a6645
PP
1897if (server_cert)
1898 {
817d9f57 1899 tls_out.peerdn = US X509_NAME_oneline(X509_get_subject_name(server_cert),
453a6645 1900 CS txt, sizeof(txt));
9d1c15ef 1901 tls_out.peerdn = txt; /*XXX a static buffer... */
453a6645
PP
1902 }
1903else
817d9f57 1904 tls_out.peerdn = NULL;
059ec3d9 1905
817d9f57
JH
1906construct_cipher_name(client_ssl, cipherbuf, sizeof(cipherbuf), &tls_out.bits);
1907tls_out.cipher = cipherbuf;
059ec3d9 1908
9d1c15ef
JH
1909/* Record the certificate we presented */
1910 {
1911 X509 * crt = SSL_get_certificate(client_ssl);
1912 tls_out.ourcert = crt ? X509_dup(crt) : NULL;
1913 }
1914
817d9f57 1915tls_out.active = fd;
059ec3d9
PH
1916return OK;
1917}
1918
1919
1920
1921
1922
1923/*************************************************
1924* TLS version of getc *
1925*************************************************/
1926
1927/* This gets the next byte from the TLS input buffer. If the buffer is empty,
1928it refills the buffer via the SSL reading function.
1929
1930Arguments: none
1931Returns: the next character or EOF
817d9f57
JH
1932
1933Only used by the server-side TLS.
059ec3d9
PH
1934*/
1935
1936int
1937tls_getc(void)
1938{
1939if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
1940 {
1941 int error;
1942 int inbytes;
1943
817d9f57 1944 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", server_ssl,
c80c5570 1945 ssl_xfer_buffer, ssl_xfer_buffer_size);
059ec3d9
PH
1946
1947 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
817d9f57
JH
1948 inbytes = SSL_read(server_ssl, CS ssl_xfer_buffer, ssl_xfer_buffer_size);
1949 error = SSL_get_error(server_ssl, inbytes);
059ec3d9
PH
1950 alarm(0);
1951
1952 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
1953 closed down, not that the socket itself has been closed down. Revert to
1954 non-SSL handling. */
1955
1956 if (error == SSL_ERROR_ZERO_RETURN)
1957 {
1958 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
1959
1960 receive_getc = smtp_getc;
1961 receive_ungetc = smtp_ungetc;
1962 receive_feof = smtp_feof;
1963 receive_ferror = smtp_ferror;
58eb016e 1964 receive_smtp_buffered = smtp_buffered;
059ec3d9 1965
817d9f57
JH
1966 SSL_free(server_ssl);
1967 server_ssl = NULL;
1968 tls_in.active = -1;
1969 tls_in.bits = 0;
1970 tls_in.cipher = NULL;
1971 tls_in.peerdn = NULL;
1972 tls_in.sni = NULL;
059ec3d9
PH
1973
1974 return smtp_getc();
1975 }
1976
1977 /* Handle genuine errors */
1978
ba084640
PP
1979 else if (error == SSL_ERROR_SSL)
1980 {
1981 ERR_error_string(ERR_get_error(), ssl_errstring);
89dd51cd 1982 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
ba084640
PP
1983 ssl_xfer_error = 1;
1984 return EOF;
1985 }
1986
059ec3d9
PH
1987 else if (error != SSL_ERROR_NONE)
1988 {
1989 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
1990 ssl_xfer_error = 1;
1991 return EOF;
1992 }
c80c5570 1993
80a47a2c
TK
1994#ifndef DISABLE_DKIM
1995 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
1996#endif
059ec3d9
PH
1997 ssl_xfer_buffer_hwm = inbytes;
1998 ssl_xfer_buffer_lwm = 0;
1999 }
2000
2001/* Something in the buffer; return next uschar */
2002
2003return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
2004}
2005
2006
2007
2008/*************************************************
2009* Read bytes from TLS channel *
2010*************************************************/
2011
2012/*
2013Arguments:
2014 buff buffer of data
2015 len size of buffer
2016
2017Returns: the number of bytes read
2018 -1 after a failed read
817d9f57
JH
2019
2020Only used by the client-side TLS.
059ec3d9
PH
2021*/
2022
2023int
389ca47a 2024tls_read(BOOL is_server, uschar *buff, size_t len)
059ec3d9 2025{
389ca47a 2026SSL *ssl = is_server ? server_ssl : client_ssl;
059ec3d9
PH
2027int inbytes;
2028int error;
2029
389ca47a 2030DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
c80c5570 2031 buff, (unsigned int)len);
059ec3d9 2032
389ca47a
JH
2033inbytes = SSL_read(ssl, CS buff, len);
2034error = SSL_get_error(ssl, inbytes);
059ec3d9
PH
2035
2036if (error == SSL_ERROR_ZERO_RETURN)
2037 {
2038 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2039 return -1;
2040 }
2041else if (error != SSL_ERROR_NONE)
2042 {
2043 return -1;
2044 }
2045
2046return inbytes;
2047}
2048
2049
2050
2051
2052
2053/*************************************************
2054* Write bytes down TLS channel *
2055*************************************************/
2056
2057/*
2058Arguments:
817d9f57 2059 is_server channel specifier
059ec3d9
PH
2060 buff buffer of data
2061 len number of bytes
2062
2063Returns: the number of bytes after a successful write,
2064 -1 after a failed write
817d9f57
JH
2065
2066Used by both server-side and client-side TLS.
059ec3d9
PH
2067*/
2068
2069int
817d9f57 2070tls_write(BOOL is_server, const uschar *buff, size_t len)
059ec3d9
PH
2071{
2072int outbytes;
2073int error;
2074int left = len;
817d9f57 2075SSL *ssl = is_server ? server_ssl : client_ssl;
059ec3d9 2076
c80c5570 2077DEBUG(D_tls) debug_printf("tls_do_write(%p, %d)\n", buff, left);
059ec3d9
PH
2078while (left > 0)
2079 {
c80c5570 2080 DEBUG(D_tls) debug_printf("SSL_write(SSL, %p, %d)\n", buff, left);
059ec3d9
PH
2081 outbytes = SSL_write(ssl, CS buff, left);
2082 error = SSL_get_error(ssl, outbytes);
2083 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
2084 switch (error)
2085 {
2086 case SSL_ERROR_SSL:
2087 ERR_error_string(ERR_get_error(), ssl_errstring);
2088 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
2089 return -1;
2090
2091 case SSL_ERROR_NONE:
2092 left -= outbytes;
2093 buff += outbytes;
2094 break;
2095
2096 case SSL_ERROR_ZERO_RETURN:
2097 log_write(0, LOG_MAIN, "SSL channel closed on write");
2098 return -1;
2099
817d9f57
JH
2100 case SSL_ERROR_SYSCALL:
2101 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
2102 sender_fullhost ? sender_fullhost : US"<unknown>",
2103 strerror(errno));
2104
059ec3d9
PH
2105 default:
2106 log_write(0, LOG_MAIN, "SSL_write error %d", error);
2107 return -1;
2108 }
2109 }
2110return len;
2111}
2112
2113
2114
2115/*************************************************
2116* Close down a TLS session *
2117*************************************************/
2118
2119/* This is also called from within a delivery subprocess forked from the
2120daemon, to shut down the TLS library, without actually doing a shutdown (which
2121would tamper with the SSL session in the parent process).
2122
2123Arguments: TRUE if SSL_shutdown is to be called
2124Returns: nothing
817d9f57
JH
2125
2126Used by both server-side and client-side TLS.
059ec3d9
PH
2127*/
2128
2129void
817d9f57 2130tls_close(BOOL is_server, BOOL shutdown)
059ec3d9 2131{
817d9f57 2132SSL **sslp = is_server ? &server_ssl : &client_ssl;
389ca47a 2133int *fdp = is_server ? &tls_in.active : &tls_out.active;
817d9f57
JH
2134
2135if (*fdp < 0) return; /* TLS was not active */
059ec3d9
PH
2136
2137if (shutdown)
2138 {
2139 DEBUG(D_tls) debug_printf("tls_close(): shutting down SSL\n");
817d9f57 2140 SSL_shutdown(*sslp);
059ec3d9
PH
2141 }
2142
817d9f57
JH
2143SSL_free(*sslp);
2144*sslp = NULL;
059ec3d9 2145
817d9f57 2146*fdp = -1;
059ec3d9
PH
2147}
2148
36f12725
NM
2149
2150
2151
2152/*************************************************
3375e053
PP
2153* Let tls_require_ciphers be checked at startup *
2154*************************************************/
2155
2156/* The tls_require_ciphers option, if set, must be something which the
2157library can parse.
2158
2159Returns: NULL on success, or error message
2160*/
2161
2162uschar *
2163tls_validate_require_cipher(void)
2164{
2165SSL_CTX *ctx;
2166uschar *s, *expciphers, *err;
2167
2168/* this duplicates from tls_init(), we need a better "init just global
2169state, for no specific purpose" singleton function of our own */
2170
2171SSL_load_error_strings();
2172OpenSSL_add_ssl_algorithms();
2173#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
2174/* SHA256 is becoming ever more popular. This makes sure it gets added to the
2175list of available digests. */
2176EVP_add_digest(EVP_sha256());
2177#endif
2178
2179if (!(tls_require_ciphers && *tls_require_ciphers))
2180 return NULL;
2181
2182if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
2183 return US"failed to expand tls_require_ciphers";
2184
2185if (!(expciphers && *expciphers))
2186 return NULL;
2187
2188/* normalisation ripped from above */
2189s = expciphers;
2190while (*s != 0) { if (*s == '_') *s = '-'; s++; }
2191
2192err = NULL;
2193
2194ctx = SSL_CTX_new(SSLv23_server_method());
2195if (!ctx)
2196 {
2197 ERR_error_string(ERR_get_error(), ssl_errstring);
2198 return string_sprintf("SSL_CTX_new() failed: %s", ssl_errstring);
2199 }
2200
2201DEBUG(D_tls)
2202 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2203
2204if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
2205 {
2206 ERR_error_string(ERR_get_error(), ssl_errstring);
2207 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed", expciphers);
2208 }
2209
2210SSL_CTX_free(ctx);
2211
2212return err;
2213}
2214
2215
2216
2217
2218/*************************************************
36f12725
NM
2219* Report the library versions. *
2220*************************************************/
2221
2222/* There have historically been some issues with binary compatibility in
2223OpenSSL libraries; if Exim (like many other applications) is built against
2224one version of OpenSSL but the run-time linker picks up another version,
2225it can result in serious failures, including crashing with a SIGSEGV. So
2226report the version found by the compiler and the run-time version.
2227
f64a1e23
PP
2228Note: some OS vendors backport security fixes without changing the version
2229number/string, and the version date remains unchanged. The _build_ date
2230will change, so we can more usefully assist with version diagnosis by also
2231reporting the build date.
2232
36f12725
NM
2233Arguments: a FILE* to print the results to
2234Returns: nothing
2235*/
2236
2237void
2238tls_version_report(FILE *f)
2239{
754a0503 2240fprintf(f, "Library version: OpenSSL: Compile: %s\n"
f64a1e23
PP
2241 " Runtime: %s\n"
2242 " : %s\n",
754a0503 2243 OPENSSL_VERSION_TEXT,
f64a1e23
PP
2244 SSLeay_version(SSLEAY_VERSION),
2245 SSLeay_version(SSLEAY_BUILT_ON));
2246/* third line is 38 characters for the %s and the line is 73 chars long;
2247the OpenSSL output includes a "built on: " prefix already. */
36f12725
NM
2248}
2249
9e3331ea
TK
2250
2251
2252
2253/*************************************************
17c76198 2254* Random number generation *
9e3331ea
TK
2255*************************************************/
2256
2257/* Pseudo-random number generation. The result is not expected to be
2258cryptographically strong but not so weak that someone will shoot themselves
2259in the foot using it as a nonce in input in some email header scheme or
2260whatever weirdness they'll twist this into. The result should handle fork()
2261and avoid repeating sequences. OpenSSL handles that for us.
2262
2263Arguments:
2264 max range maximum
2265Returns a random number in range [0, max-1]
2266*/
2267
2268int
17c76198 2269vaguely_random_number(int max)
9e3331ea
TK
2270{
2271unsigned int r;
2272int i, needed_len;
de6135a0
PP
2273static pid_t pidlast = 0;
2274pid_t pidnow;
9e3331ea
TK
2275uschar *p;
2276uschar smallbuf[sizeof(r)];
2277
2278if (max <= 1)
2279 return 0;
2280
de6135a0
PP
2281pidnow = getpid();
2282if (pidnow != pidlast)
2283 {
2284 /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
2285 is unique for each thread", this doesn't apparently apply across processes,
2286 so our own warning from vaguely_random_number_fallback() applies here too.
2287 Fix per PostgreSQL. */
2288 if (pidlast != 0)
2289 RAND_cleanup();
2290 pidlast = pidnow;
2291 }
2292
9e3331ea
TK
2293/* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
2294if (!RAND_status())
2295 {
2296 randstuff r;
2297 gettimeofday(&r.tv, NULL);
2298 r.p = getpid();
2299
2300 RAND_seed((uschar *)(&r), sizeof(r));
2301 }
2302/* We're after pseudo-random, not random; if we still don't have enough data
2303in the internal PRNG then our options are limited. We could sleep and hope
2304for entropy to come along (prayer technique) but if the system is so depleted
2305in the first place then something is likely to just keep taking it. Instead,
2306we'll just take whatever little bit of pseudo-random we can still manage to
2307get. */
2308
2309needed_len = sizeof(r);
2310/* Don't take 8 times more entropy than needed if int is 8 octets and we were
2311asked for a number less than 10. */
2312for (r = max, i = 0; r; ++i)
2313 r >>= 1;
2314i = (i + 7) / 8;
2315if (i < needed_len)
2316 needed_len = i;
2317
2318/* We do not care if crypto-strong */
17c76198
PP
2319i = RAND_pseudo_bytes(smallbuf, needed_len);
2320if (i < 0)
2321 {
2322 DEBUG(D_all)
2323 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
2324 return vaguely_random_number_fallback(max);
2325 }
2326
9e3331ea
TK
2327r = 0;
2328for (p = smallbuf; needed_len; --needed_len, ++p)
2329 {
2330 r *= 256;
2331 r += *p;
2332 }
2333
2334/* We don't particularly care about weighted results; if someone wants
2335smooth distribution and cares enough then they should submit a patch then. */
2336return r % max;
2337}
2338
77bb000f
PP
2339
2340
2341
2342/*************************************************
2343* OpenSSL option parse *
2344*************************************************/
2345
2346/* Parse one option for tls_openssl_options_parse below
2347
2348Arguments:
2349 name one option name
2350 value place to store a value for it
2351Returns success or failure in parsing
2352*/
2353
2354struct exim_openssl_option {
2355 uschar *name;
2356 long value;
2357};
2358/* We could use a macro to expand, but we need the ifdef and not all the
2359options document which version they were introduced in. Policylet: include
2360all options unless explicitly for DTLS, let the administrator choose which
2361to apply.
2362
2363This list is current as of:
e2fbf4a2
PP
2364 ==> 1.0.1b <==
2365Plus SSL_OP_SAFARI_ECDHE_ECDSA_BUG from 2013-June patch/discussion on openssl-dev
2366*/
77bb000f
PP
2367static struct exim_openssl_option exim_openssl_options[] = {
2368/* KEEP SORTED ALPHABETICALLY! */
2369#ifdef SSL_OP_ALL
73a46702 2370 { US"all", SSL_OP_ALL },
77bb000f
PP
2371#endif
2372#ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
73a46702 2373 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
77bb000f
PP
2374#endif
2375#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
73a46702 2376 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
77bb000f
PP
2377#endif
2378#ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
73a46702 2379 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
77bb000f
PP
2380#endif
2381#ifdef SSL_OP_EPHEMERAL_RSA
73a46702 2382 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
77bb000f
PP
2383#endif
2384#ifdef SSL_OP_LEGACY_SERVER_CONNECT
73a46702 2385 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
77bb000f
PP
2386#endif
2387#ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
73a46702 2388 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
77bb000f
PP
2389#endif
2390#ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
73a46702 2391 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
77bb000f
PP
2392#endif
2393#ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
73a46702 2394 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
77bb000f
PP
2395#endif
2396#ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
73a46702 2397 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
77bb000f
PP
2398#endif
2399#ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
73a46702 2400 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
77bb000f 2401#endif
c80c5570
PP
2402#ifdef SSL_OP_NO_COMPRESSION
2403 { US"no_compression", SSL_OP_NO_COMPRESSION },
2404#endif
77bb000f 2405#ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
73a46702 2406 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
77bb000f 2407#endif
c0c7b2da
PP
2408#ifdef SSL_OP_NO_SSLv2
2409 { US"no_sslv2", SSL_OP_NO_SSLv2 },
2410#endif
2411#ifdef SSL_OP_NO_SSLv3
2412 { US"no_sslv3", SSL_OP_NO_SSLv3 },
2413#endif
2414#ifdef SSL_OP_NO_TICKET
2415 { US"no_ticket", SSL_OP_NO_TICKET },
2416#endif
2417#ifdef SSL_OP_NO_TLSv1
2418 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
2419#endif
c80c5570
PP
2420#ifdef SSL_OP_NO_TLSv1_1
2421#if SSL_OP_NO_TLSv1_1 == 0x00000400L
2422 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
2423#warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
2424#else
2425 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
2426#endif
2427#endif
2428#ifdef SSL_OP_NO_TLSv1_2
2429 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
2430#endif
e2fbf4a2
PP
2431#ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
2432 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
2433#endif
77bb000f 2434#ifdef SSL_OP_SINGLE_DH_USE
73a46702 2435 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
77bb000f
PP
2436#endif
2437#ifdef SSL_OP_SINGLE_ECDH_USE
73a46702 2438 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
77bb000f
PP
2439#endif
2440#ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
73a46702 2441 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
77bb000f
PP
2442#endif
2443#ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
73a46702 2444 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
77bb000f
PP
2445#endif
2446#ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
73a46702 2447 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
77bb000f
PP
2448#endif
2449#ifdef SSL_OP_TLS_D5_BUG
73a46702 2450 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
77bb000f
PP
2451#endif
2452#ifdef SSL_OP_TLS_ROLLBACK_BUG
73a46702 2453 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
77bb000f
PP
2454#endif
2455};
2456static int exim_openssl_options_size =
2457 sizeof(exim_openssl_options)/sizeof(struct exim_openssl_option);
2458
c80c5570 2459
77bb000f
PP
2460static BOOL
2461tls_openssl_one_option_parse(uschar *name, long *value)
2462{
2463int first = 0;
2464int last = exim_openssl_options_size;
2465while (last > first)
2466 {
2467 int middle = (first + last)/2;
2468 int c = Ustrcmp(name, exim_openssl_options[middle].name);
2469 if (c == 0)
2470 {
2471 *value = exim_openssl_options[middle].value;
2472 return TRUE;
2473 }
2474 else if (c > 0)
2475 first = middle + 1;
2476 else
2477 last = middle;
2478 }
2479return FALSE;
2480}
2481
2482
2483
2484
2485/*************************************************
2486* OpenSSL option parsing logic *
2487*************************************************/
2488
2489/* OpenSSL has a number of compatibility options which an administrator might
2490reasonably wish to set. Interpret a list similarly to decode_bits(), so that
2491we look like log_selector.
2492
2493Arguments:
2494 option_spec the administrator-supplied string of options
2495 results ptr to long storage for the options bitmap
2496Returns success or failure
2497*/
2498
2499BOOL
2500tls_openssl_options_parse(uschar *option_spec, long *results)
2501{
2502long result, item;
2503uschar *s, *end;
2504uschar keep_c;
2505BOOL adding, item_parsed;
2506
0e944a0d 2507result = 0L;
b1770b6e 2508/* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
da3ad30d 2509 * from default because it increases BEAST susceptibility. */
f0f5a555
PP
2510#ifdef SSL_OP_NO_SSLv2
2511result |= SSL_OP_NO_SSLv2;
2512#endif
77bb000f
PP
2513
2514if (option_spec == NULL)
2515 {
2516 *results = result;
2517 return TRUE;
2518 }
2519
2520for (s=option_spec; *s != '\0'; /**/)
2521 {
2522 while (isspace(*s)) ++s;
2523 if (*s == '\0')
2524 break;
2525 if (*s != '+' && *s != '-')
2526 {
2527 DEBUG(D_tls) debug_printf("malformed openssl option setting: "
0e944a0d 2528 "+ or - expected but found \"%s\"\n", s);
77bb000f
PP
2529 return FALSE;
2530 }
2531 adding = *s++ == '+';
2532 for (end = s; (*end != '\0') && !isspace(*end); ++end) /**/ ;
2533 keep_c = *end;
2534 *end = '\0';
2535 item_parsed = tls_openssl_one_option_parse(s, &item);
2536 if (!item_parsed)
2537 {
0e944a0d 2538 DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
77bb000f
PP
2539 return FALSE;
2540 }
2541 DEBUG(D_tls) debug_printf("openssl option, %s from %lx: %lx (%s)\n",
2542 adding ? "adding" : "removing", result, item, s);
2543 if (adding)
2544 result |= item;
2545 else
2546 result &= ~item;
2547 *end = keep_c;
2548 s = end;
2549 }
2550
2551*results = result;
2552return TRUE;
2553}
2554
9d1c15ef
JH
2555/* vi: aw ai sw=2
2556*/
059ec3d9 2557/* End of tls-openssl.c */