Commit | Line | Data |
---|---|---|
9d1c15ef JH |
1 | /************************************************* |
2 | * Exim - an Internet mail transport agent * | |
3 | *************************************************/ | |
4 | ||
5 | /* Copyright (c) Jeremy Harris 2014 */ | |
6 | ||
7 | /* This module provides TLS (aka SSL) support for Exim using the OpenSSL | |
8 | library. It is #included into the tls.c file when that library is used. | |
9 | */ | |
10 | ||
11 | ||
12 | /* Heading stuff */ | |
13 | ||
14 | #include <openssl/lhash.h> | |
15 | #include <openssl/ssl.h> | |
16 | #include <openssl/err.h> | |
17 | #include <openssl/rand.h> | |
51424d08 | 18 | #include <openssl/x509v3.h> |
9d1c15ef JH |
19 | |
20 | ||
21 | /***************************************************** | |
22 | * Export/import a certificate, binary/printable | |
23 | *****************************************************/ | |
24 | int | |
25 | tls_export_cert(uschar * buf, size_t buflen, void * cert) | |
26 | { | |
27 | BIO * bp = BIO_new(BIO_s_mem()); | |
28 | int fail; | |
29 | ||
30 | if ((fail = PEM_write_bio_X509(bp, (X509 *)cert) ? 0 : 1)) | |
31 | log_write(0, LOG_MAIN, "TLS error in certificate export: %s", | |
32 | ERR_error_string(ERR_get_error(), NULL)); | |
33 | else | |
34 | { | |
35 | char * cp = CS buf; | |
36 | int n; | |
37 | buflen -= 2; | |
38 | for(;;) | |
39 | { | |
40 | if ((n = BIO_gets(bp, cp, (int)buflen)) <= 0) break; | |
41 | cp += n+1; | |
42 | buflen -= n+1; | |
43 | cp[-2] = '\\'; cp[-1] = 'n'; /* newline->"\n" */ | |
44 | } /* compat with string_printing() */ | |
45 | *cp = '\0'; | |
46 | } | |
47 | ||
48 | BIO_free(bp); | |
49 | return fail; | |
50 | } | |
51 | ||
52 | int | |
53 | tls_import_cert(const uschar * buf, void ** cert) | |
54 | { | |
55 | void * reset_point = store_get(0); | |
56 | const uschar * cp = string_unprinting(US buf); | |
57 | BIO * bp; | |
58 | X509 * x; | |
c03fae8a | 59 | int fail = 0; |
9d1c15ef JH |
60 | |
61 | bp = BIO_new_mem_buf(US cp, -1); | |
c03fae8a JH |
62 | if (!(x = PEM_read_bio_X509(bp, NULL, 0, NULL))) |
63 | { | |
64 | log_write(0, LOG_MAIN, "TLS error in certificate import: %s", | |
65 | ERR_error_string(ERR_get_error(), NULL)); | |
9d1c15ef | 66 | fail = 1; |
c03fae8a | 67 | } |
9d1c15ef JH |
68 | else |
69 | *cert = (void *)x; | |
70 | BIO_free(bp); | |
71 | store_reset(reset_point); | |
72 | return fail; | |
73 | } | |
74 | ||
75 | void | |
76 | tls_free_cert(void * cert) | |
77 | { | |
78 | X509_free((X509 *)cert); | |
79 | } | |
80 | ||
c03fae8a | 81 | |
9d1c15ef JH |
82 | /***************************************************** |
83 | * Certificate field extraction routines | |
84 | *****************************************************/ | |
c03fae8a JH |
85 | |
86 | /* First, some internal service functions */ | |
87 | ||
88 | static uschar * | |
89 | badalloc(void) | |
90 | { | |
91 | expand_string_message = US"allocation failure"; | |
92 | return NULL; | |
93 | } | |
94 | ||
9d1c15ef JH |
95 | static uschar * |
96 | bio_string_copy(BIO * bp, int len) | |
97 | { | |
e3dd1d67 | 98 | uschar * cp = US""; |
9d1c15ef JH |
99 | len = len > 0 ? (int) BIO_get_mem_data(bp, &cp) : 0; |
100 | cp = string_copyn(cp, len); | |
101 | BIO_free(bp); | |
102 | return cp; | |
103 | } | |
104 | ||
105 | static uschar * | |
25ba2544 JH |
106 | bio_string_time_to_int(BIO * bp, int len) |
107 | { | |
108 | uschar * cp = US""; | |
109 | struct tm t; | |
110 | len = len > 0 ? (int) BIO_get_mem_data(bp, &cp) : 0; | |
111 | /*XXX %Z might be glibc-specific? */ | |
112 | (void) strptime(CS cp, "%b%t%e%t%T%t%Y%t%Z", &t); | |
113 | BIO_free(bp); | |
114 | /*XXX timegm might not be portable? */ | |
115 | return string_sprintf("%u", (unsigned) timegm(&t)); | |
116 | } | |
117 | ||
118 | static uschar * | |
119 | asn1_time_copy(const ASN1_TIME * time, uschar * mod) | |
9d1c15ef JH |
120 | { |
121 | BIO * bp = BIO_new(BIO_s_mem()); | |
c03fae8a JH |
122 | int len; |
123 | ||
124 | if (!bp) return badalloc(); | |
125 | ||
126 | len = ASN1_TIME_print(bp, time); | |
25ba2544 JH |
127 | return mod && Ustrcmp(mod, "int") == 0 |
128 | ? bio_string_time_to_int(bp, len) | |
129 | : bio_string_copy(bp, len); | |
9d1c15ef JH |
130 | } |
131 | ||
132 | static uschar * | |
133 | x509_name_copy(X509_NAME * name) | |
134 | { | |
135 | BIO * bp = BIO_new(BIO_s_mem()); | |
c03fae8a JH |
136 | int len_good; |
137 | ||
138 | if (!bp) return badalloc(); | |
139 | ||
140 | len_good = | |
9d1c15ef JH |
141 | X509_NAME_print_ex(bp, name, 0, XN_FLAG_RFC2253) >= 0 |
142 | ? 1 : 0; | |
143 | return bio_string_copy(bp, len_good); | |
144 | } | |
145 | ||
146 | /**/ | |
c03fae8a JH |
147 | /* Now the extractors, called from expand.c |
148 | Arguments: | |
149 | cert The certificate | |
150 | mod Optional modifiers for the operator | |
151 | ||
152 | Return: | |
153 | Allocated string with extracted value | |
154 | */ | |
9d1c15ef JH |
155 | |
156 | uschar * | |
9e4dddbd | 157 | tls_cert_issuer(void * cert, uschar * mod) |
9d1c15ef | 158 | { |
812a6045 JH |
159 | uschar * cp = x509_name_copy(X509_get_issuer_name((X509 *)cert)); |
160 | return mod ? tls_field_from_dn(cp, mod) : cp; | |
9d1c15ef JH |
161 | } |
162 | ||
163 | uschar * | |
9e4dddbd | 164 | tls_cert_not_before(void * cert, uschar * mod) |
9d1c15ef | 165 | { |
25ba2544 | 166 | return asn1_time_copy(X509_get_notBefore((X509 *)cert), mod); |
9d1c15ef JH |
167 | } |
168 | ||
169 | uschar * | |
9e4dddbd | 170 | tls_cert_not_after(void * cert, uschar * mod) |
9d1c15ef | 171 | { |
25ba2544 | 172 | return asn1_time_copy(X509_get_notAfter((X509 *)cert), mod); |
9d1c15ef JH |
173 | } |
174 | ||
175 | uschar * | |
9e4dddbd | 176 | tls_cert_serial_number(void * cert, uschar * mod) |
9d1c15ef JH |
177 | { |
178 | uschar txt[256]; | |
179 | BIO * bp = BIO_new(BIO_s_mem()); | |
c03fae8a | 180 | int len; |
9d1c15ef | 181 | |
c03fae8a JH |
182 | if (!bp) return badalloc(); |
183 | ||
184 | len = i2a_ASN1_INTEGER(bp, X509_get_serialNumber((X509 *)cert)); | |
9d1c15ef JH |
185 | if (len < sizeof(txt)) |
186 | BIO_read(bp, txt, len); | |
187 | else | |
188 | len = 0; | |
189 | BIO_free(bp); | |
190 | return string_copynlc(txt, len); /* lowercase */ | |
191 | } | |
192 | ||
193 | uschar * | |
9e4dddbd | 194 | tls_cert_signature(void * cert, uschar * mod) |
9d1c15ef | 195 | { |
9d1c15ef | 196 | uschar * cp = NULL; |
c03fae8a JH |
197 | BIO * bp = BIO_new(BIO_s_mem()); |
198 | ||
199 | if (!bp) return badalloc(); | |
9d1c15ef JH |
200 | |
201 | if (X509_print_ex(bp, (X509 *)cert, 0, | |
202 | X509_FLAG_NO_HEADER | X509_FLAG_NO_VERSION | X509_FLAG_NO_SERIAL | | |
203 | X509_FLAG_NO_SIGNAME | X509_FLAG_NO_ISSUER | X509_FLAG_NO_VALIDITY | | |
204 | X509_FLAG_NO_SUBJECT | X509_FLAG_NO_PUBKEY | X509_FLAG_NO_EXTENSIONS | | |
205 | /* X509_FLAG_NO_SIGDUMP is the missing one */ | |
206 | X509_FLAG_NO_AUX) == 1) | |
207 | { | |
208 | long len = BIO_get_mem_data(bp, &cp); | |
315e209a JH |
209 | |
210 | /* Strip leading "Signature Algorithm" line */ | |
211 | while (*cp && *cp != '\n') { cp++; len--; } | |
212 | ||
213 | cp = string_copyn(cp+1, len-1); | |
9d1c15ef JH |
214 | } |
215 | BIO_free(bp); | |
216 | return cp; | |
217 | } | |
218 | ||
219 | uschar * | |
9e4dddbd | 220 | tls_cert_signature_algorithm(void * cert, uschar * mod) |
9d1c15ef | 221 | { |
315e209a JH |
222 | uschar * cp = NULL; |
223 | BIO * bp = BIO_new(BIO_s_mem()); | |
224 | ||
225 | if (!bp) return badalloc(); | |
226 | ||
227 | if (X509_print_ex(bp, (X509 *)cert, 0, | |
228 | X509_FLAG_NO_HEADER | X509_FLAG_NO_VERSION | X509_FLAG_NO_SERIAL | | |
229 | /* X509_FLAG_NO_SIGNAME is the missing one */ | |
230 | X509_FLAG_NO_ISSUER | X509_FLAG_NO_VALIDITY | | |
231 | X509_FLAG_NO_SUBJECT | X509_FLAG_NO_PUBKEY | X509_FLAG_NO_EXTENSIONS | | |
232 | X509_FLAG_NO_SIGDUMP | X509_FLAG_NO_AUX) == 1) | |
233 | { | |
234 | long len = BIO_get_mem_data(bp, &cp); | |
235 | ||
236 | /* Strip leading " Signature Algorithm: " and trailing newline */ | |
237 | while (*cp && *cp != ':') { cp++; len--; } | |
238 | do { cp++; len--; } while (*cp && *cp == ' '); | |
239 | if (cp[len-1] == '\n') len--; | |
240 | ||
241 | cp = string_copyn(cp, len); | |
242 | } | |
243 | BIO_free(bp); | |
244 | return cp; | |
9d1c15ef JH |
245 | } |
246 | ||
247 | uschar * | |
9e4dddbd | 248 | tls_cert_subject(void * cert, uschar * mod) |
9d1c15ef | 249 | { |
812a6045 JH |
250 | uschar * cp = x509_name_copy(X509_get_subject_name((X509 *)cert)); |
251 | return mod ? tls_field_from_dn(cp, mod) : cp; | |
9d1c15ef JH |
252 | } |
253 | ||
254 | uschar * | |
9e4dddbd | 255 | tls_cert_version(void * cert, uschar * mod) |
9d1c15ef JH |
256 | { |
257 | return string_sprintf("%d", X509_get_version((X509 *)cert)); | |
258 | } | |
259 | ||
260 | uschar * | |
261 | tls_cert_ext_by_oid(void * cert, uschar * oid, int idx) | |
262 | { | |
e3dd1d67 | 263 | int nid = OBJ_create(CS oid, "", ""); |
9d1c15ef JH |
264 | int nidx = X509_get_ext_by_NID((X509 *)cert, nid, idx); |
265 | X509_EXTENSION * ex = X509_get_ext((X509 *)cert, nidx); | |
266 | ASN1_OCTET_STRING * adata = X509_EXTENSION_get_data(ex); | |
267 | BIO * bp = BIO_new(BIO_s_mem()); | |
268 | long len; | |
269 | uschar * cp1; | |
270 | uschar * cp2; | |
271 | uschar * cp3; | |
272 | ||
c03fae8a JH |
273 | if (!bp) return badalloc(); |
274 | ||
9d1c15ef JH |
275 | M_ASN1_OCTET_STRING_print(bp, adata); |
276 | /* binary data, DER encoded */ | |
277 | ||
278 | /* just dump for now */ | |
279 | len = BIO_get_mem_data(bp, &cp1); | |
280 | cp3 = cp2 = store_get(len*3+1); | |
281 | ||
282 | while(len) | |
283 | { | |
e3dd1d67 | 284 | sprintf(CS cp2, "%.2x ", *cp1++); |
9d1c15ef JH |
285 | cp2 += 3; |
286 | len--; | |
287 | } | |
288 | cp2[-1] = '\0'; | |
289 | ||
290 | return cp3; | |
291 | } | |
292 | ||
293 | uschar * | |
9e4dddbd | 294 | tls_cert_subject_altname(void * cert, uschar * mod) |
9d1c15ef | 295 | { |
9e4dddbd | 296 | uschar * list = NULL; |
9d1c15ef JH |
297 | STACK_OF(GENERAL_NAME) * san = (STACK_OF(GENERAL_NAME) *) |
298 | X509_get_ext_d2i((X509 *)cert, NID_subject_alt_name, NULL, NULL); | |
9e4dddbd JH |
299 | uschar sep = '\n'; |
300 | uschar * tag = US""; | |
301 | uschar * ele; | |
302 | int match = -1; | |
e51c7be2 | 303 | int len; |
9d1c15ef JH |
304 | |
305 | if (!san) return NULL; | |
306 | ||
9e4dddbd JH |
307 | while (mod) |
308 | { | |
309 | if (*mod == '>' && *++mod) sep = *mod++; | |
310 | else if (Ustrcmp(mod, "dns")==0) { match = GEN_DNS; mod += 3; } | |
311 | else if (Ustrcmp(mod, "uri")==0) { match = GEN_URI; mod += 3; } | |
312 | else if (Ustrcmp(mod, "mail")==0) { match = GEN_EMAIL; mod += 4; } | |
313 | else continue; | |
314 | ||
315 | if (*mod++ != ',') | |
316 | break; | |
317 | } | |
318 | ||
9d1c15ef JH |
319 | while (sk_GENERAL_NAME_num(san) > 0) |
320 | { | |
321 | GENERAL_NAME * namePart = sk_GENERAL_NAME_pop(san); | |
9e4dddbd JH |
322 | if (match != -1 && match != namePart->type) |
323 | continue; | |
9d1c15ef JH |
324 | switch (namePart->type) |
325 | { | |
9e4dddbd JH |
326 | case GEN_DNS: |
327 | tag = US"DNS"; | |
328 | ele = ASN1_STRING_data(namePart->d.dNSName); | |
e51c7be2 | 329 | len = ASN1_STRING_length(namePart->d.dNSName); |
9e4dddbd | 330 | break; |
9d1c15ef | 331 | case GEN_URI: |
9e4dddbd JH |
332 | tag = US"URI"; |
333 | ele = ASN1_STRING_data(namePart->d.uniformResourceIdentifier); | |
e51c7be2 | 334 | len = ASN1_STRING_length(namePart->d.uniformResourceIdentifier); |
9e4dddbd | 335 | break; |
9d1c15ef | 336 | case GEN_EMAIL: |
9e4dddbd JH |
337 | tag = US"MAIL"; |
338 | ele = ASN1_STRING_data(namePart->d.rfc822Name); | |
e51c7be2 | 339 | len = ASN1_STRING_length(namePart->d.rfc822Name); |
9e4dddbd | 340 | break; |
9d1c15ef | 341 | default: |
9e4dddbd | 342 | continue; /* ignore unrecognised types */ |
9d1c15ef | 343 | } |
e51c7be2 JH |
344 | if (ele[len]) /* not nul-terminated */ |
345 | ele = string_copyn(ele, len); | |
346 | ||
347 | if (strnlen(CS ele, len) == len) /* ignore any with embedded nul */ | |
348 | list = string_append_listele(list, sep, | |
9e4dddbd | 349 | match == -1 ? string_sprintf("%s=%s", tag, ele) : ele); |
9d1c15ef JH |
350 | } |
351 | ||
9e4dddbd JH |
352 | sk_GENERAL_NAME_free(san); |
353 | return list; | |
9d1c15ef JH |
354 | } |
355 | ||
356 | uschar * | |
9e4dddbd | 357 | tls_cert_ocsp_uri(void * cert, uschar * mod) |
9d1c15ef JH |
358 | { |
359 | STACK_OF(ACCESS_DESCRIPTION) * ads = (STACK_OF(ACCESS_DESCRIPTION) *) | |
360 | X509_get_ext_d2i((X509 *)cert, NID_info_access, NULL, NULL); | |
361 | int adsnum = sk_ACCESS_DESCRIPTION_num(ads); | |
362 | int i; | |
9e4dddbd JH |
363 | uschar sep = '\n'; |
364 | uschar * list = NULL; | |
365 | ||
366 | if (mod) | |
367 | if (*mod == '>' && *++mod) sep = *mod++; | |
9d1c15ef JH |
368 | |
369 | for (i = 0; i < adsnum; i++) | |
370 | { | |
371 | ACCESS_DESCRIPTION * ad = sk_ACCESS_DESCRIPTION_value(ads, i); | |
372 | ||
373 | if (ad && OBJ_obj2nid(ad->method) == NID_ad_OCSP) | |
9e4dddbd JH |
374 | list = string_append_listele(list, sep, |
375 | ASN1_STRING_data(ad->location->d.ia5)); | |
9d1c15ef | 376 | } |
9e4dddbd | 377 | return list; |
9d1c15ef JH |
378 | } |
379 | ||
380 | uschar * | |
9e4dddbd | 381 | tls_cert_crl_uri(void * cert, uschar * mod) |
9d1c15ef JH |
382 | { |
383 | STACK_OF(DIST_POINT) * dps = (STACK_OF(DIST_POINT) *) | |
384 | X509_get_ext_d2i((X509 *)cert, NID_crl_distribution_points, | |
385 | NULL, NULL); | |
386 | DIST_POINT * dp; | |
387 | int dpsnum = sk_DIST_POINT_num(dps); | |
388 | int i; | |
9e4dddbd JH |
389 | uschar sep = '\n'; |
390 | uschar * list = NULL; | |
391 | ||
392 | if (mod) | |
393 | if (*mod == '>' && *++mod) sep = *mod++; | |
9d1c15ef JH |
394 | |
395 | if (dps) for (i = 0; i < dpsnum; i++) | |
396 | if ((dp = sk_DIST_POINT_value(dps, i))) | |
397 | { | |
398 | STACK_OF(GENERAL_NAME) * names = dp->distpoint->name.fullname; | |
399 | GENERAL_NAME * np; | |
400 | int nnum = sk_GENERAL_NAME_num(names); | |
401 | int j; | |
402 | ||
403 | for (j = 0; j < nnum; j++) | |
404 | if ( (np = sk_GENERAL_NAME_value(names, j)) | |
405 | && np->type == GEN_URI | |
406 | ) | |
9e4dddbd JH |
407 | list = string_append_listele(list, sep, |
408 | ASN1_STRING_data(np->d.uniformResourceIdentifier)); | |
9d1c15ef | 409 | } |
9e4dddbd | 410 | return list; |
9d1c15ef JH |
411 | } |
412 | ||
6a8a60e0 JH |
413 | |
414 | ||
415 | /***************************************************** | |
416 | * Certificate operator routines | |
417 | *****************************************************/ | |
418 | static uschar * | |
419 | fingerprint(X509 * cert, const EVP_MD * fdig) | |
420 | { | |
421 | int j; | |
422 | unsigned int n; | |
423 | uschar md[EVP_MAX_MD_SIZE]; | |
424 | uschar * cp; | |
425 | ||
426 | if (!X509_digest(cert,fdig,md,&n)) | |
427 | { | |
428 | expand_string_message = US"tls_cert_fprt: out of mem\n"; | |
429 | return NULL; | |
430 | } | |
431 | cp = store_get(n*2+1); | |
e3dd1d67 | 432 | for (j = 0; j < (int)n; j++) sprintf(CS cp+2*j, "%02X", md[j]); |
6a8a60e0 JH |
433 | return(cp); |
434 | } | |
435 | ||
436 | uschar * | |
437 | tls_cert_fprt_md5(void * cert) | |
438 | { | |
439 | return fingerprint((X509 *)cert, EVP_md5()); | |
440 | } | |
441 | ||
442 | uschar * | |
443 | tls_cert_fprt_sha1(void * cert) | |
444 | { | |
445 | return fingerprint((X509 *)cert, EVP_sha1()); | |
446 | } | |
447 | ||
9ef9101c JH |
448 | uschar * |
449 | tls_cert_fprt_sha256(void * cert) | |
450 | { | |
451 | return fingerprint((X509 *)cert, EVP_sha256()); | |
452 | } | |
453 | ||
6a8a60e0 | 454 | |
9d1c15ef JH |
455 | /* vi: aw ai sw=2 |
456 | */ | |
457 | /* End of tlscert-openssl.c */ |