OpenSSL: support OCSP stapling on multi-cert servers
[exim.git] / src / src / tls-openssl.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2019 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Portions Copyright (c) The OpenSSL Project 1999 */
9
10 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
11 library. It is #included into the tls.c file when that library is used. The
12 code herein is based on a patch that was originally contributed by Steve
13 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
14
15 No cryptographic code is included in Exim. All this module does is to call
16 functions from the OpenSSL library. */
17
18
19 /* Heading stuff */
20
21 #include <openssl/lhash.h>
22 #include <openssl/ssl.h>
23 #include <openssl/err.h>
24 #include <openssl/rand.h>
25 #ifndef OPENSSL_NO_ECDH
26 # include <openssl/ec.h>
27 #endif
28 #ifndef DISABLE_OCSP
29 # include <openssl/ocsp.h>
30 #endif
31 #ifdef SUPPORT_DANE
32 # include "danessl.h"
33 #endif
34
35
36 #ifndef DISABLE_OCSP
37 # define EXIM_OCSP_SKEW_SECONDS (300L)
38 # define EXIM_OCSP_MAX_AGE (-1L)
39 #endif
40
41 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
42 # define EXIM_HAVE_OPENSSL_TLSEXT
43 #endif
44 #if OPENSSL_VERSION_NUMBER >= 0x00908000L
45 # define EXIM_HAVE_RSA_GENKEY_EX
46 #endif
47 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
48 # define EXIM_HAVE_OCSP_RESP_COUNT
49 #else
50 # define EXIM_HAVE_EPHEM_RSA_KEX
51 # define EXIM_HAVE_RAND_PSEUDO
52 #endif
53 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
54 # define EXIM_HAVE_SHA256
55 #endif
56
57 /* X509_check_host provides sane certificate hostname checking, but was added
58 to OpenSSL late, after other projects forked off the code-base. So in
59 addition to guarding against the base version number, beware that LibreSSL
60 does not (at this time) support this function.
61
62 If LibreSSL gains a different API, perhaps via libtls, then we'll probably
63 opt to disentangle and ask a LibreSSL user to provide glue for a third
64 crypto provider for libtls instead of continuing to tie the OpenSSL glue
65 into even twistier knots. If LibreSSL gains the same API, we can just
66 change this guard and punt the issue for a while longer. */
67
68 #ifndef LIBRESSL_VERSION_NUMBER
69 # if OPENSSL_VERSION_NUMBER >= 0x010100000L
70 # define EXIM_HAVE_OPENSSL_CHECKHOST
71 # define EXIM_HAVE_OPENSSL_DH_BITS
72 # define EXIM_HAVE_OPENSSL_TLS_METHOD
73 # define EXIM_HAVE_OPENSSL_KEYLOG
74 # define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
75 # define EXIM_HAVE_SESSION_TICKET
76 # define EXIM_HAVE_OPESSL_TRACE
77 # else
78 # define EXIM_NEED_OPENSSL_INIT
79 # endif
80 # if OPENSSL_VERSION_NUMBER >= 0x010000000L \
81 && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
82 # define EXIM_HAVE_OPENSSL_CHECKHOST
83 # endif
84 #endif
85
86 #if !defined(LIBRESSL_VERSION_NUMBER) \
87 || LIBRESSL_VERSION_NUMBER >= 0x20010000L
88 # if !defined(OPENSSL_NO_ECDH)
89 # if OPENSSL_VERSION_NUMBER >= 0x0090800fL
90 # define EXIM_HAVE_ECDH
91 # endif
92 # if OPENSSL_VERSION_NUMBER >= 0x10002000L
93 # define EXIM_HAVE_OPENSSL_EC_NIST2NID
94 # endif
95 # endif
96 #endif
97
98 #ifndef LIBRESSL_VERSION_NUMBER
99 # if OPENSSL_VERSION_NUMBER >= 0x010101000L
100 # define OPENSSL_HAVE_KEYLOG_CB
101 # define OPENSSL_HAVE_NUM_TICKETS
102 # define EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
103 # endif
104 #endif
105
106 #if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
107 # warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
108 # define DISABLE_OCSP
109 #endif
110
111 #ifdef EXPERIMENTAL_TLS_RESUME
112 # if OPENSSL_VERSION_NUMBER < 0x0101010L
113 # error OpenSSL version too old for session-resumption
114 # endif
115 #endif
116
117 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
118 # include <openssl/x509v3.h>
119 #endif
120
121 #ifndef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
122 # ifndef EXIM_HAVE_OPENSSL_CIPHER_GET_ID
123 # define SSL_CIPHER_get_id(c) (c->id)
124 # endif
125 # ifndef MACRO_PREDEF
126 # include "tls-cipher-stdname.c"
127 # endif
128 #endif
129
130 /*************************************************
131 * OpenSSL option parse *
132 *************************************************/
133
134 typedef struct exim_openssl_option {
135 uschar *name;
136 long value;
137 } exim_openssl_option;
138 /* We could use a macro to expand, but we need the ifdef and not all the
139 options document which version they were introduced in. Policylet: include
140 all options unless explicitly for DTLS, let the administrator choose which
141 to apply.
142
143 This list is current as of:
144 ==> 1.0.1b <==
145 Plus SSL_OP_SAFARI_ECDHE_ECDSA_BUG from 2013-June patch/discussion on openssl-dev
146 Plus SSL_OP_NO_TLSv1_3 for 1.1.2-dev
147 */
148 static exim_openssl_option exim_openssl_options[] = {
149 /* KEEP SORTED ALPHABETICALLY! */
150 #ifdef SSL_OP_ALL
151 { US"all", (long) SSL_OP_ALL },
152 #endif
153 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
154 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
155 #endif
156 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
157 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
158 #endif
159 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
160 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
161 #endif
162 #ifdef SSL_OP_EPHEMERAL_RSA
163 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
164 #endif
165 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
166 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
167 #endif
168 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
169 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
170 #endif
171 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
172 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
173 #endif
174 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
175 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
176 #endif
177 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
178 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
179 #endif
180 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
181 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
182 #endif
183 #ifdef SSL_OP_NO_COMPRESSION
184 { US"no_compression", SSL_OP_NO_COMPRESSION },
185 #endif
186 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
187 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
188 #endif
189 #ifdef SSL_OP_NO_SSLv2
190 { US"no_sslv2", SSL_OP_NO_SSLv2 },
191 #endif
192 #ifdef SSL_OP_NO_SSLv3
193 { US"no_sslv3", SSL_OP_NO_SSLv3 },
194 #endif
195 #ifdef SSL_OP_NO_TICKET
196 { US"no_ticket", SSL_OP_NO_TICKET },
197 #endif
198 #ifdef SSL_OP_NO_TLSv1
199 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
200 #endif
201 #ifdef SSL_OP_NO_TLSv1_1
202 #if SSL_OP_NO_TLSv1_1 == 0x00000400L
203 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
204 #warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
205 #else
206 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
207 #endif
208 #endif
209 #ifdef SSL_OP_NO_TLSv1_2
210 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
211 #endif
212 #ifdef SSL_OP_NO_TLSv1_3
213 { US"no_tlsv1_3", SSL_OP_NO_TLSv1_3 },
214 #endif
215 #ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
216 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
217 #endif
218 #ifdef SSL_OP_SINGLE_DH_USE
219 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
220 #endif
221 #ifdef SSL_OP_SINGLE_ECDH_USE
222 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
223 #endif
224 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
225 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
226 #endif
227 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
228 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
229 #endif
230 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
231 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
232 #endif
233 #ifdef SSL_OP_TLS_D5_BUG
234 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
235 #endif
236 #ifdef SSL_OP_TLS_ROLLBACK_BUG
237 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
238 #endif
239 };
240
241 #ifndef MACRO_PREDEF
242 static int exim_openssl_options_size = nelem(exim_openssl_options);
243 #endif
244
245 #ifdef MACRO_PREDEF
246 void
247 options_tls(void)
248 {
249 uschar buf[64];
250
251 for (struct exim_openssl_option * o = exim_openssl_options;
252 o < exim_openssl_options + nelem(exim_openssl_options); o++)
253 {
254 /* Trailing X is workaround for problem with _OPT_OPENSSL_NO_TLSV1
255 being a ".ifdef _OPT_OPENSSL_NO_TLSV1_3" match */
256
257 spf(buf, sizeof(buf), US"_OPT_OPENSSL_%T_X", o->name);
258 builtin_macro_create(buf);
259 }
260
261 # ifdef EXPERIMENTAL_TLS_RESUME
262 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
263 # endif
264 # ifdef SSL_OP_NO_TLSv1_3
265 builtin_macro_create(US"_HAVE_TLS1_3");
266 # endif
267 }
268 #else
269
270 /******************************************************************************/
271
272 /* Structure for collecting random data for seeding. */
273
274 typedef struct randstuff {
275 struct timeval tv;
276 pid_t p;
277 } randstuff;
278
279 /* Local static variables */
280
281 static BOOL client_verify_callback_called = FALSE;
282 static BOOL server_verify_callback_called = FALSE;
283 static const uschar *sid_ctx = US"exim";
284
285 /* We have three different contexts to care about.
286
287 Simple case: client, `client_ctx`
288 As a client, we can be doing a callout or cut-through delivery while receiving
289 a message. So we have a client context, which should have options initialised
290 from the SMTP Transport. We may also concurrently want to make TLS connections
291 to utility daemons, so client-contexts are allocated and passed around in call
292 args rather than using a gobal.
293
294 Server:
295 There are two cases: with and without ServerNameIndication from the client.
296 Given TLS SNI, we can be using different keys, certs and various other
297 configuration settings, because they're re-expanded with $tls_sni set. This
298 allows vhosting with TLS. This SNI is sent in the handshake.
299 A client might not send SNI, so we need a fallback, and an initial setup too.
300 So as a server, we start out using `server_ctx`.
301 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
302 `server_sni` from `server_ctx` and then initialise settings by re-expanding
303 configuration.
304 */
305
306 typedef struct {
307 SSL_CTX * ctx;
308 SSL * ssl;
309 gstring * corked;
310 } exim_openssl_client_tls_ctx;
311
312 static SSL_CTX *server_ctx = NULL;
313 static SSL *server_ssl = NULL;
314
315 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
316 static SSL_CTX *server_sni = NULL;
317 #endif
318
319 static char ssl_errstring[256];
320
321 static int ssl_session_timeout = 7200; /* Two hours */
322 static BOOL client_verify_optional = FALSE;
323 static BOOL server_verify_optional = FALSE;
324
325 static BOOL reexpand_tls_files_for_sni = FALSE;
326
327
328 typedef struct ocsp_resp {
329 struct ocsp_resp * next;
330 OCSP_RESPONSE * resp;
331 } ocsp_resplist;
332
333 typedef struct tls_ext_ctx_cb {
334 tls_support * tlsp;
335 uschar *certificate;
336 uschar *privatekey;
337 BOOL is_server;
338 #ifndef DISABLE_OCSP
339 STACK_OF(X509) *verify_stack; /* chain for verifying the proof */
340 union {
341 struct {
342 uschar *file;
343 const uschar *file_expanded;
344 ocsp_resplist *olist;
345 } server;
346 struct {
347 X509_STORE *verify_store; /* non-null if status requested */
348 BOOL verify_required;
349 } client;
350 } u_ocsp;
351 #endif
352 uschar *dhparam;
353 /* these are cached from first expand */
354 uschar *server_cipher_list;
355 /* only passed down to tls_error: */
356 host_item *host;
357 const uschar * verify_cert_hostnames;
358 #ifndef DISABLE_EVENT
359 uschar * event_action;
360 #endif
361 } tls_ext_ctx_cb;
362
363 /* should figure out a cleanup of API to handle state preserved per
364 implementation, for various reasons, which can be void * in the APIs.
365 For now, we hack around it. */
366 tls_ext_ctx_cb *client_static_cbinfo = NULL; /*XXX should not use static; multiple concurrent clients! */
367 tls_ext_ctx_cb *server_static_cbinfo = NULL;
368
369 static int
370 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
371 int (*cert_vfy_cb)(int, X509_STORE_CTX *), uschar ** errstr );
372
373 /* Callbacks */
374 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
375 static int tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg);
376 #endif
377 #ifndef DISABLE_OCSP
378 static int tls_server_stapling_cb(SSL *s, void *arg);
379 #endif
380
381
382
383 /* Daemon-called, before every connection, key create/rotate */
384 #ifdef EXPERIMENTAL_TLS_RESUME
385 static void tk_init(void);
386 static int tls_exdata_idx = -1;
387 #endif
388
389 void
390 tls_daemon_init(void)
391 {
392 #ifdef EXPERIMENTAL_TLS_RESUME
393 tk_init();
394 #endif
395 return;
396 }
397
398
399 /*************************************************
400 * Handle TLS error *
401 *************************************************/
402
403 /* Called from lots of places when errors occur before actually starting to do
404 the TLS handshake, that is, while the session is still in clear. Always returns
405 DEFER for a server and FAIL for a client so that most calls can use "return
406 tls_error(...)" to do this processing and then give an appropriate return. A
407 single function is used for both server and client, because it is called from
408 some shared functions.
409
410 Argument:
411 prefix text to include in the logged error
412 host NULL if setting up a server;
413 the connected host if setting up a client
414 msg error message or NULL if we should ask OpenSSL
415 errstr pointer to output error message
416
417 Returns: OK/DEFER/FAIL
418 */
419
420 static int
421 tls_error(uschar * prefix, const host_item * host, uschar * msg, uschar ** errstr)
422 {
423 if (!msg)
424 {
425 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
426 msg = US ssl_errstring;
427 }
428
429 msg = string_sprintf("(%s): %s", prefix, msg);
430 DEBUG(D_tls) debug_printf("TLS error '%s'\n", msg);
431 if (errstr) *errstr = msg;
432 return host ? FAIL : DEFER;
433 }
434
435
436
437 /*************************************************
438 * Callback to generate RSA key *
439 *************************************************/
440
441 /*
442 Arguments:
443 s SSL connection (not used)
444 export not used
445 keylength keylength
446
447 Returns: pointer to generated key
448 */
449
450 static RSA *
451 rsa_callback(SSL *s, int export, int keylength)
452 {
453 RSA *rsa_key;
454 #ifdef EXIM_HAVE_RSA_GENKEY_EX
455 BIGNUM *bn = BN_new();
456 #endif
457
458 export = export; /* Shut picky compilers up */
459 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
460
461 #ifdef EXIM_HAVE_RSA_GENKEY_EX
462 if ( !BN_set_word(bn, (unsigned long)RSA_F4)
463 || !(rsa_key = RSA_new())
464 || !RSA_generate_key_ex(rsa_key, keylength, bn, NULL)
465 )
466 #else
467 if (!(rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL)))
468 #endif
469
470 {
471 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
472 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
473 ssl_errstring);
474 return NULL;
475 }
476 return rsa_key;
477 }
478
479
480
481 /* Extreme debug
482 #ifndef DISABLE_OCSP
483 void
484 x509_store_dump_cert_s_names(X509_STORE * store)
485 {
486 STACK_OF(X509_OBJECT) * roots= store->objs;
487 static uschar name[256];
488
489 for (int i= 0; i < sk_X509_OBJECT_num(roots); i++)
490 {
491 X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
492 if(tmp_obj->type == X509_LU_X509)
493 {
494 X509_NAME * sn = X509_get_subject_name(tmp_obj->data.x509);
495 if (X509_NAME_oneline(sn, CS name, sizeof(name)))
496 {
497 name[sizeof(name)-1] = '\0';
498 debug_printf(" %s\n", name);
499 }
500 }
501 }
502 }
503 #endif
504 */
505
506
507 #ifndef DISABLE_EVENT
508 static int
509 verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
510 BOOL *calledp, const BOOL *optionalp, const uschar * what)
511 {
512 uschar * ev;
513 uschar * yield;
514 X509 * old_cert;
515
516 ev = tlsp == &tls_out ? client_static_cbinfo->event_action : event_action;
517 if (ev)
518 {
519 DEBUG(D_tls) debug_printf("verify_event: %s %d\n", what, depth);
520 old_cert = tlsp->peercert;
521 tlsp->peercert = X509_dup(cert);
522 /* NB we do not bother setting peerdn */
523 if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth))))
524 {
525 log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
526 "depth=%d cert=%s: %s",
527 tlsp == &tls_out ? deliver_host_address : sender_host_address,
528 what, depth, dn, yield);
529 *calledp = TRUE;
530 if (!*optionalp)
531 {
532 if (old_cert) tlsp->peercert = old_cert; /* restore 1st failing cert */
533 return 1; /* reject (leaving peercert set) */
534 }
535 DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
536 "(host in tls_try_verify_hosts)\n");
537 tlsp->verify_override = TRUE;
538 }
539 X509_free(tlsp->peercert);
540 tlsp->peercert = old_cert;
541 }
542 return 0;
543 }
544 #endif
545
546 /*************************************************
547 * Callback for verification *
548 *************************************************/
549
550 /* The SSL library does certificate verification if set up to do so. This
551 callback has the current yes/no state is in "state". If verification succeeded,
552 we set the certificate-verified flag. If verification failed, what happens
553 depends on whether the client is required to present a verifiable certificate
554 or not.
555
556 If verification is optional, we change the state to yes, but still log the
557 verification error. For some reason (it really would help to have proper
558 documentation of OpenSSL), this callback function then gets called again, this
559 time with state = 1. We must take care not to set the private verified flag on
560 the second time through.
561
562 Note: this function is not called if the client fails to present a certificate
563 when asked. We get here only if a certificate has been received. Handling of
564 optional verification for this case is done when requesting SSL to verify, by
565 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
566
567 May be called multiple times for different issues with a certificate, even
568 for a given "depth" in the certificate chain.
569
570 Arguments:
571 preverify_ok current yes/no state as 1/0
572 x509ctx certificate information.
573 tlsp per-direction (client vs. server) support data
574 calledp has-been-called flag
575 optionalp verification-is-optional flag
576
577 Returns: 0 if verification should fail, otherwise 1
578 */
579
580 static int
581 verify_callback(int preverify_ok, X509_STORE_CTX * x509ctx,
582 tls_support * tlsp, BOOL * calledp, BOOL * optionalp)
583 {
584 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
585 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
586 uschar dn[256];
587
588 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
589 {
590 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
591 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
592 tlsp == &tls_out ? deliver_host_address : sender_host_address);
593 return 0;
594 }
595 dn[sizeof(dn)-1] = '\0';
596
597 tlsp->verify_override = FALSE;
598 if (preverify_ok == 0)
599 {
600 uschar * extra = verify_mode ? string_sprintf(" (during %c-verify for [%s])",
601 *verify_mode, sender_host_address)
602 : US"";
603 log_write(0, LOG_MAIN, "[%s] SSL verify error%s: depth=%d error=%s cert=%s",
604 tlsp == &tls_out ? deliver_host_address : sender_host_address,
605 extra, depth,
606 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)), dn);
607 *calledp = TRUE;
608 if (!*optionalp)
609 {
610 if (!tlsp->peercert)
611 tlsp->peercert = X509_dup(cert); /* record failing cert */
612 return 0; /* reject */
613 }
614 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
615 "tls_try_verify_hosts)\n");
616 tlsp->verify_override = TRUE;
617 }
618
619 else if (depth != 0)
620 {
621 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);
622 #ifndef DISABLE_OCSP
623 if (tlsp == &tls_out && client_static_cbinfo->u_ocsp.client.verify_store)
624 { /* client, wanting stapling */
625 /* Add the server cert's signing chain as the one
626 for the verification of the OCSP stapled information. */
627
628 if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
629 cert))
630 ERR_clear_error();
631 sk_X509_push(client_static_cbinfo->verify_stack, cert);
632 }
633 #endif
634 #ifndef DISABLE_EVENT
635 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
636 return 0; /* reject, with peercert set */
637 #endif
638 }
639 else
640 {
641 const uschar * verify_cert_hostnames;
642
643 if ( tlsp == &tls_out
644 && ((verify_cert_hostnames = client_static_cbinfo->verify_cert_hostnames)))
645 /* client, wanting hostname check */
646 {
647
648 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
649 # ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
650 # define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
651 # endif
652 # ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
653 # define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
654 # endif
655 int sep = 0;
656 const uschar * list = verify_cert_hostnames;
657 uschar * name;
658 int rc;
659 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
660 if ((rc = X509_check_host(cert, CCS name, 0,
661 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
662 | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS,
663 NULL)))
664 {
665 if (rc < 0)
666 {
667 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
668 tlsp == &tls_out ? deliver_host_address : sender_host_address);
669 name = NULL;
670 }
671 break;
672 }
673 if (!name)
674 #else
675 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
676 #endif
677 {
678 uschar * extra = verify_mode
679 ? string_sprintf(" (during %c-verify for [%s])",
680 *verify_mode, sender_host_address)
681 : US"";
682 log_write(0, LOG_MAIN,
683 "[%s] SSL verify error%s: certificate name mismatch: DN=\"%s\" H=\"%s\"",
684 tlsp == &tls_out ? deliver_host_address : sender_host_address,
685 extra, dn, verify_cert_hostnames);
686 *calledp = TRUE;
687 if (!*optionalp)
688 {
689 if (!tlsp->peercert)
690 tlsp->peercert = X509_dup(cert); /* record failing cert */
691 return 0; /* reject */
692 }
693 DEBUG(D_tls) debug_printf("SSL verify name failure overridden (host in "
694 "tls_try_verify_hosts)\n");
695 tlsp->verify_override = TRUE;
696 }
697 }
698
699 #ifndef DISABLE_EVENT
700 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
701 return 0; /* reject, with peercert set */
702 #endif
703
704 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
705 *calledp ? "" : " authenticated", dn);
706 *calledp = TRUE;
707 }
708
709 return 1; /* accept, at least for this level */
710 }
711
712 static int
713 verify_callback_client(int preverify_ok, X509_STORE_CTX *x509ctx)
714 {
715 return verify_callback(preverify_ok, x509ctx, &tls_out,
716 &client_verify_callback_called, &client_verify_optional);
717 }
718
719 static int
720 verify_callback_server(int preverify_ok, X509_STORE_CTX *x509ctx)
721 {
722 return verify_callback(preverify_ok, x509ctx, &tls_in,
723 &server_verify_callback_called, &server_verify_optional);
724 }
725
726
727 #ifdef SUPPORT_DANE
728
729 /* This gets called *by* the dane library verify callback, which interposes
730 itself.
731 */
732 static int
733 verify_callback_client_dane(int preverify_ok, X509_STORE_CTX * x509ctx)
734 {
735 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
736 uschar dn[256];
737 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
738 #ifndef DISABLE_EVENT
739 BOOL dummy_called, optional = FALSE;
740 #endif
741
742 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
743 {
744 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
745 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
746 deliver_host_address);
747 return 0;
748 }
749 dn[sizeof(dn)-1] = '\0';
750
751 DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s depth %d %s\n",
752 preverify_ok ? "ok":"BAD", depth, dn);
753
754 #ifndef DISABLE_EVENT
755 if (verify_event(&tls_out, cert, depth, dn,
756 &dummy_called, &optional, US"DANE"))
757 return 0; /* reject, with peercert set */
758 #endif
759
760 if (preverify_ok == 1)
761 {
762 tls_out.dane_verified = TRUE;
763 #ifndef DISABLE_OCSP
764 if (client_static_cbinfo->u_ocsp.client.verify_store)
765 { /* client, wanting stapling */
766 /* Add the server cert's signing chain as the one
767 for the verification of the OCSP stapled information. */
768
769 if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
770 cert))
771 ERR_clear_error();
772 sk_X509_push(client_static_cbinfo->verify_stack, cert);
773 }
774 #endif
775 }
776 else
777 {
778 int err = X509_STORE_CTX_get_error(x509ctx);
779 DEBUG(D_tls)
780 debug_printf(" - err %d '%s'\n", err, X509_verify_cert_error_string(err));
781 if (err == X509_V_ERR_APPLICATION_VERIFICATION)
782 preverify_ok = 1;
783 }
784 return preverify_ok;
785 }
786
787 #endif /*SUPPORT_DANE*/
788
789
790 /*************************************************
791 * Information callback *
792 *************************************************/
793
794 /* The SSL library functions call this from time to time to indicate what they
795 are doing. We copy the string to the debugging output when TLS debugging has
796 been requested.
797
798 Arguments:
799 s the SSL connection
800 where
801 ret
802
803 Returns: nothing
804 */
805
806 static void
807 info_callback(SSL *s, int where, int ret)
808 {
809 DEBUG(D_tls)
810 {
811 const uschar * str;
812
813 if (where & SSL_ST_CONNECT)
814 str = US"SSL_connect";
815 else if (where & SSL_ST_ACCEPT)
816 str = US"SSL_accept";
817 else
818 str = US"SSL info (undefined)";
819
820 if (where & SSL_CB_LOOP)
821 debug_printf("%s: %s\n", str, SSL_state_string_long(s));
822 else if (where & SSL_CB_ALERT)
823 debug_printf("SSL3 alert %s:%s:%s\n",
824 str = where & SSL_CB_READ ? US"read" : US"write",
825 SSL_alert_type_string_long(ret), SSL_alert_desc_string_long(ret));
826 else if (where & SSL_CB_EXIT)
827 if (ret == 0)
828 debug_printf("%s: failed in %s\n", str, SSL_state_string_long(s));
829 else if (ret < 0)
830 debug_printf("%s: error in %s\n", str, SSL_state_string_long(s));
831 else if (where & SSL_CB_HANDSHAKE_START)
832 debug_printf("%s: hshake start: %s\n", str, SSL_state_string_long(s));
833 else if (where & SSL_CB_HANDSHAKE_DONE)
834 debug_printf("%s: hshake done: %s\n", str, SSL_state_string_long(s));
835 }
836 }
837
838 #ifdef OPENSSL_HAVE_KEYLOG_CB
839 static void
840 keylog_callback(const SSL *ssl, const char *line)
841 {
842 DEBUG(D_tls) debug_printf("%.200s\n", line);
843 }
844 #endif
845
846
847 #ifdef EXPERIMENTAL_TLS_RESUME
848 /* Manage the keysets used for encrypting the session tickets, on the server. */
849
850 typedef struct { /* Session ticket encryption key */
851 uschar name[16];
852
853 const EVP_CIPHER * aes_cipher;
854 uschar aes_key[32]; /* size needed depends on cipher. aes_128 implies 128/8 = 16? */
855 const EVP_MD * hmac_hash;
856 uschar hmac_key[16];
857 time_t renew;
858 time_t expire;
859 } exim_stek;
860
861 static exim_stek exim_tk; /* current key */
862 static exim_stek exim_tk_old; /* previous key */
863
864 static void
865 tk_init(void)
866 {
867 time_t t = time(NULL);
868
869 if (exim_tk.name[0])
870 {
871 if (exim_tk.renew >= t) return;
872 exim_tk_old = exim_tk;
873 }
874
875 if (f.running_in_test_harness) ssl_session_timeout = 6;
876
877 DEBUG(D_tls) debug_printf("OpenSSL: %s STEK\n", exim_tk.name[0] ? "rotating" : "creating");
878 if (RAND_bytes(exim_tk.aes_key, sizeof(exim_tk.aes_key)) <= 0) return;
879 if (RAND_bytes(exim_tk.hmac_key, sizeof(exim_tk.hmac_key)) <= 0) return;
880 if (RAND_bytes(exim_tk.name+1, sizeof(exim_tk.name)-1) <= 0) return;
881
882 exim_tk.name[0] = 'E';
883 exim_tk.aes_cipher = EVP_aes_256_cbc();
884 exim_tk.hmac_hash = EVP_sha256();
885 exim_tk.expire = t + ssl_session_timeout;
886 exim_tk.renew = t + ssl_session_timeout/2;
887 }
888
889 static exim_stek *
890 tk_current(void)
891 {
892 if (!exim_tk.name[0]) return NULL;
893 return &exim_tk;
894 }
895
896 static exim_stek *
897 tk_find(const uschar * name)
898 {
899 return memcmp(name, exim_tk.name, sizeof(exim_tk.name)) == 0 ? &exim_tk
900 : memcmp(name, exim_tk_old.name, sizeof(exim_tk_old.name)) == 0 ? &exim_tk_old
901 : NULL;
902 }
903
904 /* Callback for session tickets, on server */
905 static int
906 ticket_key_callback(SSL * ssl, uschar key_name[16],
907 uschar * iv, EVP_CIPHER_CTX * ctx, HMAC_CTX * hctx, int enc)
908 {
909 tls_support * tlsp = server_static_cbinfo->tlsp;
910 exim_stek * key;
911
912 if (enc)
913 {
914 DEBUG(D_tls) debug_printf("ticket_key_callback: create new session\n");
915 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
916
917 if (RAND_bytes(iv, EVP_MAX_IV_LENGTH) <= 0)
918 return -1; /* insufficient random */
919
920 if (!(key = tk_current())) /* current key doesn't exist or isn't valid */
921 return 0; /* key couldn't be created */
922 memcpy(key_name, key->name, 16);
923 DEBUG(D_tls) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - time(NULL));
924
925 /*XXX will want these dependent on the ssl session strength */
926 HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
927 key->hmac_hash, NULL);
928 EVP_EncryptInit_ex(ctx, key->aes_cipher, NULL, key->aes_key, iv);
929
930 DEBUG(D_tls) debug_printf("ticket created\n");
931 return 1;
932 }
933 else
934 {
935 time_t now = time(NULL);
936
937 DEBUG(D_tls) debug_printf("ticket_key_callback: retrieve session\n");
938 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
939
940 if (!(key = tk_find(key_name)) || key->expire < now)
941 {
942 DEBUG(D_tls)
943 {
944 debug_printf("ticket not usable (%s)\n", key ? "expired" : "not found");
945 if (key) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - now);
946 }
947 return 0;
948 }
949
950 HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
951 key->hmac_hash, NULL);
952 EVP_DecryptInit_ex(ctx, key->aes_cipher, NULL, key->aes_key, iv);
953
954 DEBUG(D_tls) debug_printf("ticket usable, STEK expire " TIME_T_FMT "\n", key->expire - now);
955
956 /* The ticket lifetime and renewal are the same as the STEK lifetime and
957 renewal, which is overenthusiastic. A factor of, say, 3x longer STEK would
958 be better. To do that we'd have to encode ticket lifetime in the name as
959 we don't yet see the restored session. Could check posthandshake for TLS1.3
960 and trigger a new ticket then, but cannot do that for TLS1.2 */
961 return key->renew < now ? 2 : 1;
962 }
963 }
964 #endif
965
966
967
968 /*************************************************
969 * Initialize for DH *
970 *************************************************/
971
972 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
973
974 Arguments:
975 sctx The current SSL CTX (inbound or outbound)
976 dhparam DH parameter file or fixed parameter identity string
977 host connected host, if client; NULL if server
978 errstr error string pointer
979
980 Returns: TRUE if OK (nothing to set up, or setup worked)
981 */
982
983 static BOOL
984 init_dh(SSL_CTX *sctx, uschar *dhparam, const host_item *host, uschar ** errstr)
985 {
986 BIO *bio;
987 DH *dh;
988 uschar *dhexpanded;
989 const char *pem;
990 int dh_bitsize;
991
992 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded, errstr))
993 return FALSE;
994
995 if (!dhexpanded || !*dhexpanded)
996 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
997 else if (dhexpanded[0] == '/')
998 {
999 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
1000 {
1001 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
1002 host, US strerror(errno), errstr);
1003 return FALSE;
1004 }
1005 }
1006 else
1007 {
1008 if (Ustrcmp(dhexpanded, "none") == 0)
1009 {
1010 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
1011 return TRUE;
1012 }
1013
1014 if (!(pem = std_dh_prime_named(dhexpanded)))
1015 {
1016 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
1017 host, US strerror(errno), errstr);
1018 return FALSE;
1019 }
1020 bio = BIO_new_mem_buf(CS pem, -1);
1021 }
1022
1023 if (!(dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)))
1024 {
1025 BIO_free(bio);
1026 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
1027 host, NULL, errstr);
1028 return FALSE;
1029 }
1030
1031 /* note: our default limit of 2236 is not a multiple of 8; the limit comes from
1032 * an NSS limit, and the GnuTLS APIs handle bit-sizes fine, so we went with
1033 * 2236. But older OpenSSL can only report in bytes (octets), not bits.
1034 * If someone wants to dance at the edge, then they can raise the limit or use
1035 * current libraries. */
1036 #ifdef EXIM_HAVE_OPENSSL_DH_BITS
1037 /* Added in commit 26c79d5641d; `git describe --contains` says OpenSSL_1_1_0-pre1~1022
1038 * This predates OpenSSL_1_1_0 (before a, b, ...) so is in all 1.1.0 */
1039 dh_bitsize = DH_bits(dh);
1040 #else
1041 dh_bitsize = 8 * DH_size(dh);
1042 #endif
1043
1044 /* Even if it is larger, we silently return success rather than cause things
1045 * to fail out, so that a too-large DH will not knock out all TLS; it's a
1046 * debatable choice. */
1047 if (dh_bitsize > tls_dh_max_bits)
1048 {
1049 DEBUG(D_tls)
1050 debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d\n",
1051 dh_bitsize, tls_dh_max_bits);
1052 }
1053 else
1054 {
1055 SSL_CTX_set_tmp_dh(sctx, dh);
1056 DEBUG(D_tls)
1057 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
1058 dhexpanded ? dhexpanded : US"default", dh_bitsize);
1059 }
1060
1061 DH_free(dh);
1062 BIO_free(bio);
1063
1064 return TRUE;
1065 }
1066
1067
1068
1069
1070 /*************************************************
1071 * Initialize for ECDH *
1072 *************************************************/
1073
1074 /* Load parameters for ECDH encryption.
1075
1076 For now, we stick to NIST P-256 because: it's simple and easy to configure;
1077 it avoids any patent issues that might bite redistributors; despite events in
1078 the news and concerns over curve choices, we're not cryptographers, we're not
1079 pretending to be, and this is "good enough" to be better than no support,
1080 protecting against most adversaries. Given another year or two, there might
1081 be sufficient clarity about a "right" way forward to let us make an informed
1082 decision, instead of a knee-jerk reaction.
1083
1084 Longer-term, we should look at supporting both various named curves and
1085 external files generated with "openssl ecparam", much as we do for init_dh().
1086 We should also support "none" as a value, to explicitly avoid initialisation.
1087
1088 Patches welcome.
1089
1090 Arguments:
1091 sctx The current SSL CTX (inbound or outbound)
1092 host connected host, if client; NULL if server
1093 errstr error string pointer
1094
1095 Returns: TRUE if OK (nothing to set up, or setup worked)
1096 */
1097
1098 static BOOL
1099 init_ecdh(SSL_CTX * sctx, host_item * host, uschar ** errstr)
1100 {
1101 #ifdef OPENSSL_NO_ECDH
1102 return TRUE;
1103 #else
1104
1105 EC_KEY * ecdh;
1106 uschar * exp_curve;
1107 int nid;
1108 BOOL rv;
1109
1110 if (host) /* No ECDH setup for clients, only for servers */
1111 return TRUE;
1112
1113 # ifndef EXIM_HAVE_ECDH
1114 DEBUG(D_tls)
1115 debug_printf("No OpenSSL API to define ECDH parameters, skipping\n");
1116 return TRUE;
1117 # else
1118
1119 if (!expand_check(tls_eccurve, US"tls_eccurve", &exp_curve, errstr))
1120 return FALSE;
1121 if (!exp_curve || !*exp_curve)
1122 return TRUE;
1123
1124 /* "auto" needs to be handled carefully.
1125 * OpenSSL < 1.0.2: we do not select anything, but fallback to prime256v1
1126 * OpenSSL < 1.1.0: we have to call SSL_CTX_set_ecdh_auto
1127 * (openssl/ssl.h defines SSL_CTRL_SET_ECDH_AUTO)
1128 * OpenSSL >= 1.1.0: we do not set anything, the libray does autoselection
1129 * https://github.com/openssl/openssl/commit/fe6ef2472db933f01b59cad82aa925736935984b
1130 */
1131 if (Ustrcmp(exp_curve, "auto") == 0)
1132 {
1133 #if OPENSSL_VERSION_NUMBER < 0x10002000L
1134 DEBUG(D_tls) debug_printf(
1135 "ECDH OpenSSL < 1.0.2: temp key parameter settings: overriding \"auto\" with \"prime256v1\"\n");
1136 exp_curve = US"prime256v1";
1137 #else
1138 # if defined SSL_CTRL_SET_ECDH_AUTO
1139 DEBUG(D_tls) debug_printf(
1140 "ECDH OpenSSL 1.0.2+ temp key parameter settings: autoselection\n");
1141 SSL_CTX_set_ecdh_auto(sctx, 1);
1142 return TRUE;
1143 # else
1144 DEBUG(D_tls) debug_printf(
1145 "ECDH OpenSSL 1.1.0+ temp key parameter settings: default selection\n");
1146 return TRUE;
1147 # endif
1148 #endif
1149 }
1150
1151 DEBUG(D_tls) debug_printf("ECDH: curve '%s'\n", exp_curve);
1152 if ( (nid = OBJ_sn2nid (CCS exp_curve)) == NID_undef
1153 # ifdef EXIM_HAVE_OPENSSL_EC_NIST2NID
1154 && (nid = EC_curve_nist2nid(CCS exp_curve)) == NID_undef
1155 # endif
1156 )
1157 {
1158 tls_error(string_sprintf("Unknown curve name tls_eccurve '%s'", exp_curve),
1159 host, NULL, errstr);
1160 return FALSE;
1161 }
1162
1163 if (!(ecdh = EC_KEY_new_by_curve_name(nid)))
1164 {
1165 tls_error(US"Unable to create ec curve", host, NULL, errstr);
1166 return FALSE;
1167 }
1168
1169 /* The "tmp" in the name here refers to setting a temporary key
1170 not to the stability of the interface. */
1171
1172 if ((rv = SSL_CTX_set_tmp_ecdh(sctx, ecdh) == 0))
1173 tls_error(string_sprintf("Error enabling '%s' curve", exp_curve), host, NULL, errstr);
1174 else
1175 DEBUG(D_tls) debug_printf("ECDH: enabled '%s' curve\n", exp_curve);
1176
1177 EC_KEY_free(ecdh);
1178 return !rv;
1179
1180 # endif /*EXIM_HAVE_ECDH*/
1181 #endif /*OPENSSL_NO_ECDH*/
1182 }
1183
1184
1185
1186
1187 #ifndef DISABLE_OCSP
1188 /*************************************************
1189 * Load OCSP information into state *
1190 *************************************************/
1191 /* Called to load the server OCSP response from the given file into memory, once
1192 caller has determined this is needed. Checks validity. Debugs a message
1193 if invalid.
1194
1195 ASSUMES: single response, for single cert.
1196
1197 Arguments:
1198 sctx the SSL_CTX* to update
1199 cbinfo various parts of session state
1200 filename the filename putatively holding an OCSP response
1201
1202 */
1203
1204 static void
1205 ocsp_load_response(SSL_CTX * sctx, tls_ext_ctx_cb * cbinfo,
1206 const uschar * filename)
1207 {
1208 BIO * bio;
1209 OCSP_RESPONSE * resp;
1210 OCSP_BASICRESP * basic_response;
1211 OCSP_SINGLERESP * single_response;
1212 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
1213 STACK_OF(X509) * sk;
1214 unsigned long verify_flags;
1215 int status, reason, i;
1216
1217 DEBUG(D_tls) debug_printf("tls_ocsp_file '%s'\n", filename);
1218
1219 if (!(bio = BIO_new_file(CS filename, "rb")))
1220 {
1221 DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
1222 filename);
1223 return;
1224 }
1225
1226 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
1227 BIO_free(bio);
1228 if (!resp)
1229 {
1230 DEBUG(D_tls) debug_printf("Error reading OCSP response.\n");
1231 return;
1232 }
1233
1234 if ((status = OCSP_response_status(resp)) != OCSP_RESPONSE_STATUS_SUCCESSFUL)
1235 {
1236 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
1237 OCSP_response_status_str(status), status);
1238 goto bad;
1239 }
1240
1241 #ifdef notdef
1242 {
1243 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
1244 OCSP_RESPONSE_print(bp, resp, 0); /* extreme debug: stapling content */
1245 BIO_free(bp);
1246 }
1247 #endif
1248
1249 if (!(basic_response = OCSP_response_get1_basic(resp)))
1250 {
1251 DEBUG(D_tls)
1252 debug_printf("OCSP response parse error: unable to extract basic response.\n");
1253 goto bad;
1254 }
1255
1256 sk = cbinfo->verify_stack;
1257 verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
1258
1259 /* May need to expose ability to adjust those flags?
1260 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
1261 OCSP_TRUSTOTHER OCSP_NOINTERN */
1262
1263 /* This does a full verify on the OCSP proof before we load it for serving
1264 up; possibly overkill - just date-checks might be nice enough.
1265
1266 OCSP_basic_verify takes a "store" arg, but does not
1267 use it for the chain verification, which is all we do
1268 when OCSP_NOVERIFY is set. The content from the wire
1269 "basic_response" and a cert-stack "sk" are all that is used.
1270
1271 We have a stack, loaded in setup_certs() if tls_verify_certificates
1272 was a file (not a directory, or "system"). It is unfortunate we
1273 cannot used the connection context store, as that would neatly
1274 handle the "system" case too, but there seems to be no library
1275 function for getting a stack from a store.
1276 [ In OpenSSL 1.1 - ? X509_STORE_CTX_get0_chain(ctx) ? ]
1277 We do not free the stack since it could be needed a second time for
1278 SNI handling.
1279
1280 Separately we might try to replace using OCSP_basic_verify() - which seems to not
1281 be a public interface into the OpenSSL library (there's no manual entry) -
1282 But what with? We also use OCSP_basic_verify in the client stapling callback.
1283 And there we NEED it; we must verify that status... unless the
1284 library does it for us anyway? */
1285
1286 if ((i = OCSP_basic_verify(basic_response, sk, NULL, verify_flags)) < 0)
1287 {
1288 DEBUG(D_tls)
1289 {
1290 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
1291 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
1292 }
1293 goto bad;
1294 }
1295
1296 /* Here's the simplifying assumption: there's only one response, for the
1297 one certificate we use, and nothing for anything else in a chain. If this
1298 proves false, we need to extract a cert id from our issued cert
1299 (tls_certificate) and use that for OCSP_resp_find_status() (which finds the
1300 right cert in the stack and then calls OCSP_single_get0_status()).
1301
1302 I'm hoping to avoid reworking a bunch more of how we handle state here.
1303
1304 XXX that will change when we add support for (TLS1.3) whole-chain stapling
1305 */
1306
1307 if (!(single_response = OCSP_resp_get0(basic_response, 0)))
1308 {
1309 DEBUG(D_tls)
1310 debug_printf("Unable to get first response from OCSP basic response.\n");
1311 goto bad;
1312 }
1313
1314 status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
1315 if (status != V_OCSP_CERTSTATUS_GOOD)
1316 {
1317 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
1318 OCSP_cert_status_str(status), status,
1319 OCSP_crl_reason_str(reason), reason);
1320 goto bad;
1321 }
1322
1323 if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1324 {
1325 DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
1326 goto bad;
1327 }
1328
1329 supply_response:
1330 /* Add the resp to the list used by tls_server_stapling_cb() */
1331 {
1332 ocsp_resplist ** op = &cbinfo->u_ocsp.server.olist, * oentry;
1333 while (oentry = *op)
1334 op = &oentry->next;
1335 *op = oentry = store_get(sizeof(ocsp_resplist), FALSE);
1336 oentry->next = NULL;
1337 oentry->resp = resp;
1338 }
1339 return;
1340
1341 bad:
1342 if (f.running_in_test_harness)
1343 {
1344 extern char ** environ;
1345 if (environ) for (uschar ** p = USS environ; *p; p++)
1346 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1347 {
1348 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
1349 goto supply_response;
1350 }
1351 }
1352 return;
1353 }
1354
1355
1356 static void
1357 ocsp_free_response_list(tls_ext_ctx_cb * cbinfo)
1358 {
1359 for (ocsp_resplist * olist = cbinfo->u_ocsp.server.olist; olist;
1360 olist = olist->next)
1361 OCSP_RESPONSE_free(olist->resp);
1362 cbinfo->u_ocsp.server.olist = NULL;
1363 }
1364 #endif /*!DISABLE_OCSP*/
1365
1366
1367
1368
1369 /* Create and install a selfsigned certificate, for use in server mode */
1370
1371 static int
1372 tls_install_selfsign(SSL_CTX * sctx, uschar ** errstr)
1373 {
1374 X509 * x509 = NULL;
1375 EVP_PKEY * pkey;
1376 RSA * rsa;
1377 X509_NAME * name;
1378 uschar * where;
1379
1380 where = US"allocating pkey";
1381 if (!(pkey = EVP_PKEY_new()))
1382 goto err;
1383
1384 where = US"allocating cert";
1385 if (!(x509 = X509_new()))
1386 goto err;
1387
1388 where = US"generating pkey";
1389 if (!(rsa = rsa_callback(NULL, 0, 2048)))
1390 goto err;
1391
1392 where = US"assigning pkey";
1393 if (!EVP_PKEY_assign_RSA(pkey, rsa))
1394 goto err;
1395
1396 X509_set_version(x509, 2); /* N+1 - version 3 */
1397 ASN1_INTEGER_set(X509_get_serialNumber(x509), 1);
1398 X509_gmtime_adj(X509_get_notBefore(x509), 0);
1399 X509_gmtime_adj(X509_get_notAfter(x509), (long)60 * 60); /* 1 hour */
1400 X509_set_pubkey(x509, pkey);
1401
1402 name = X509_get_subject_name(x509);
1403 X509_NAME_add_entry_by_txt(name, "C",
1404 MBSTRING_ASC, CUS "UK", -1, -1, 0);
1405 X509_NAME_add_entry_by_txt(name, "O",
1406 MBSTRING_ASC, CUS "Exim Developers", -1, -1, 0);
1407 X509_NAME_add_entry_by_txt(name, "CN",
1408 MBSTRING_ASC, CUS smtp_active_hostname, -1, -1, 0);
1409 X509_set_issuer_name(x509, name);
1410
1411 where = US"signing cert";
1412 if (!X509_sign(x509, pkey, EVP_md5()))
1413 goto err;
1414
1415 where = US"installing selfsign cert";
1416 if (!SSL_CTX_use_certificate(sctx, x509))
1417 goto err;
1418
1419 where = US"installing selfsign key";
1420 if (!SSL_CTX_use_PrivateKey(sctx, pkey))
1421 goto err;
1422
1423 return OK;
1424
1425 err:
1426 (void) tls_error(where, NULL, NULL, errstr);
1427 if (x509) X509_free(x509);
1428 if (pkey) EVP_PKEY_free(pkey);
1429 return DEFER;
1430 }
1431
1432
1433
1434
1435 static int
1436 tls_add_certfile(SSL_CTX * sctx, tls_ext_ctx_cb * cbinfo, uschar * file,
1437 uschar ** errstr)
1438 {
1439 DEBUG(D_tls) debug_printf("tls_certificate file '%s'\n", file);
1440 if (!SSL_CTX_use_certificate_chain_file(sctx, CS file))
1441 return tls_error(string_sprintf(
1442 "SSL_CTX_use_certificate_chain_file file=%s", file),
1443 cbinfo->host, NULL, errstr);
1444 return 0;
1445 }
1446
1447 static int
1448 tls_add_pkeyfile(SSL_CTX * sctx, tls_ext_ctx_cb * cbinfo, uschar * file,
1449 uschar ** errstr)
1450 {
1451 DEBUG(D_tls) debug_printf("tls_privatekey file '%s'\n", file);
1452 if (!SSL_CTX_use_PrivateKey_file(sctx, CS file, SSL_FILETYPE_PEM))
1453 return tls_error(string_sprintf(
1454 "SSL_CTX_use_PrivateKey_file file=%s", file), cbinfo->host, NULL, errstr);
1455 return 0;
1456 }
1457
1458
1459 /*************************************************
1460 * Expand key and cert file specs *
1461 *************************************************/
1462
1463 /* Called once during tls_init and possibly again during TLS setup, for a
1464 new context, if Server Name Indication was used and tls_sni was seen in
1465 the certificate string.
1466
1467 Arguments:
1468 sctx the SSL_CTX* to update
1469 cbinfo various parts of session state
1470 errstr error string pointer
1471
1472 Returns: OK/DEFER/FAIL
1473 */
1474
1475 static int
1476 tls_expand_session_files(SSL_CTX * sctx, tls_ext_ctx_cb * cbinfo,
1477 uschar ** errstr)
1478 {
1479 uschar * expanded;
1480
1481 if (!cbinfo->certificate)
1482 {
1483 if (!cbinfo->is_server) /* client */
1484 return OK;
1485 /* server */
1486 if (tls_install_selfsign(sctx, errstr) != OK)
1487 return DEFER;
1488 }
1489 else
1490 {
1491 int err;
1492
1493 if ( !reexpand_tls_files_for_sni
1494 && ( Ustrstr(cbinfo->certificate, US"tls_sni")
1495 || Ustrstr(cbinfo->certificate, US"tls_in_sni")
1496 || Ustrstr(cbinfo->certificate, US"tls_out_sni")
1497 ) )
1498 reexpand_tls_files_for_sni = TRUE;
1499
1500 if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded, errstr))
1501 return DEFER;
1502
1503 if (expanded)
1504 if (cbinfo->is_server)
1505 {
1506 const uschar * file_list = expanded;
1507 int sep = 0;
1508 uschar * file;
1509 #ifndef DISABLE_OCSP
1510 const uschar * olist = cbinfo->u_ocsp.server.file;
1511 int osep = 0;
1512 uschar * ofile;
1513
1514 if (olist)
1515 if (!expand_check(olist, US"tls_ocsp_file", USS &olist, errstr))
1516 return DEFER;
1517 if (olist && !*olist)
1518 olist = NULL;
1519
1520 if ( cbinfo->u_ocsp.server.file_expanded && olist
1521 && (Ustrcmp(olist, cbinfo->u_ocsp.server.file_expanded) == 0))
1522 {
1523 DEBUG(D_tls) debug_printf(" - value unchanged, using existing values\n");
1524 olist = NULL;
1525 }
1526 else
1527 {
1528 ocsp_free_response_list(cbinfo);
1529 cbinfo->u_ocsp.server.file_expanded = olist;
1530 }
1531 #endif
1532
1533 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1534 {
1535 if ((err = tls_add_certfile(sctx, cbinfo, file, errstr)))
1536 return err;
1537
1538 #ifndef DISABLE_OCSP
1539 if (olist)
1540 if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1541 ocsp_load_response(sctx, cbinfo, ofile);
1542 else
1543 DEBUG(D_tls) debug_printf("ran out of ocsp file list\n");
1544 #endif
1545 }
1546 }
1547 else /* would there ever be a need for multiple client certs? */
1548 if ((err = tls_add_certfile(sctx, cbinfo, expanded, errstr)))
1549 return err;
1550
1551 if ( cbinfo->privatekey
1552 && !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded, errstr))
1553 return DEFER;
1554
1555 /* If expansion was forced to fail, key_expanded will be NULL. If the result
1556 of the expansion is an empty string, ignore it also, and assume the private
1557 key is in the same file as the certificate. */
1558
1559 if (expanded && *expanded)
1560 if (cbinfo->is_server)
1561 {
1562 const uschar * file_list = expanded;
1563 int sep = 0;
1564 uschar * file;
1565
1566 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1567 if ((err = tls_add_pkeyfile(sctx, cbinfo, file, errstr)))
1568 return err;
1569 }
1570 else /* would there ever be a need for multiple client certs? */
1571 if ((err = tls_add_pkeyfile(sctx, cbinfo, expanded, errstr)))
1572 return err;
1573 }
1574
1575 return OK;
1576 }
1577
1578
1579
1580
1581 /*************************************************
1582 * Callback to handle SNI *
1583 *************************************************/
1584
1585 /* Called when acting as server during the TLS session setup if a Server Name
1586 Indication extension was sent by the client.
1587
1588 API documentation is OpenSSL s_server.c implementation.
1589
1590 Arguments:
1591 s SSL* of the current session
1592 ad unknown (part of OpenSSL API) (unused)
1593 arg Callback of "our" registered data
1594
1595 Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
1596
1597 XXX might need to change to using ClientHello callback,
1598 per https://www.openssl.org/docs/manmaster/man3/SSL_client_hello_cb_fn.html
1599 */
1600
1601 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
1602 static int
1603 tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
1604 {
1605 const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
1606 tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
1607 int rc;
1608 int old_pool = store_pool;
1609 uschar * dummy_errstr;
1610
1611 if (!servername)
1612 return SSL_TLSEXT_ERR_OK;
1613
1614 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
1615 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
1616
1617 /* Make the extension value available for expansion */
1618 store_pool = POOL_PERM;
1619 tls_in.sni = string_copy_taint(US servername, TRUE);
1620 store_pool = old_pool;
1621
1622 if (!reexpand_tls_files_for_sni)
1623 return SSL_TLSEXT_ERR_OK;
1624
1625 /* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
1626 not confident that memcpy wouldn't break some internal reference counting.
1627 Especially since there's a references struct member, which would be off. */
1628
1629 #ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
1630 if (!(server_sni = SSL_CTX_new(TLS_server_method())))
1631 #else
1632 if (!(server_sni = SSL_CTX_new(SSLv23_server_method())))
1633 #endif
1634 {
1635 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
1636 DEBUG(D_tls) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring);
1637 goto bad;
1638 }
1639
1640 /* Not sure how many of these are actually needed, since SSL object
1641 already exists. Might even need this selfsame callback, for reneg? */
1642
1643 SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(server_ctx));
1644 SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(server_ctx));
1645 SSL_CTX_set_options(server_sni, SSL_CTX_get_options(server_ctx));
1646 SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(server_ctx));
1647 SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
1648 SSL_CTX_set_tlsext_servername_arg(server_sni, cbinfo);
1649
1650 if ( !init_dh(server_sni, cbinfo->dhparam, NULL, &dummy_errstr)
1651 || !init_ecdh(server_sni, NULL, &dummy_errstr)
1652 )
1653 goto bad;
1654
1655 if ( cbinfo->server_cipher_list
1656 && !SSL_CTX_set_cipher_list(server_sni, CS cbinfo->server_cipher_list))
1657 goto bad;
1658
1659 #ifndef DISABLE_OCSP
1660 if (cbinfo->u_ocsp.server.file)
1661 {
1662 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
1663 SSL_CTX_set_tlsext_status_arg(server_sni, cbinfo);
1664 }
1665 #endif
1666
1667 if ((rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE,
1668 verify_callback_server, &dummy_errstr)) != OK)
1669 goto bad;
1670
1671 /* do this after setup_certs, because this can require the certs for verifying
1672 OCSP information. */
1673 if ((rc = tls_expand_session_files(server_sni, cbinfo, &dummy_errstr)) != OK)
1674 goto bad;
1675
1676 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
1677 SSL_set_SSL_CTX(s, server_sni);
1678 return SSL_TLSEXT_ERR_OK;
1679
1680 bad: return SSL_TLSEXT_ERR_ALERT_FATAL;
1681 }
1682 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
1683
1684
1685
1686
1687 #ifndef DISABLE_OCSP
1688
1689 /*************************************************
1690 * Callback to handle OCSP Stapling *
1691 *************************************************/
1692
1693 /* Called when acting as server during the TLS session setup if the client
1694 requests OCSP information with a Certificate Status Request.
1695
1696 Documentation via openssl s_server.c and the Apache patch from the OpenSSL
1697 project.
1698
1699 */
1700
1701 static int
1702 tls_server_stapling_cb(SSL *s, void *arg)
1703 {
1704 const tls_ext_ctx_cb * cbinfo = (tls_ext_ctx_cb *) arg;
1705 ocsp_resplist * olist = cbinfo->u_ocsp.server.olist;
1706 uschar * response_der; /*XXX blob */
1707 int response_der_len;
1708
1709 DEBUG(D_tls)
1710 debug_printf("Received TLS status request (OCSP stapling); %s response list\n",
1711 olist ? "have" : "lack");
1712
1713 tls_in.ocsp = OCSP_NOT_RESP;
1714 if (!olist)
1715 return SSL_TLSEXT_ERR_NOACK;
1716
1717 {
1718 const X509 * cert_sent = SSL_get_certificate(s);
1719 const ASN1_INTEGER * cert_serial = X509_get0_serialNumber(cert_sent);
1720 const BIGNUM * cert_bn = ASN1_INTEGER_to_BN(cert_serial, NULL);
1721 const X509_NAME * cert_issuer = X509_get_issuer_name(cert_sent);
1722 uschar * chash;
1723 uint chash_len;
1724
1725 for (; olist; olist = olist->next)
1726 {
1727 OCSP_BASICRESP * bs = OCSP_response_get1_basic(olist->resp);
1728 const OCSP_SINGLERESP * single = OCSP_resp_get0(bs, 0);
1729 const OCSP_CERTID * cid = OCSP_SINGLERESP_get0_id(single);
1730 ASN1_INTEGER * res_cert_serial;
1731 const BIGNUM * resp_bn;
1732 ASN1_OCTET_STRING * res_cert_iNameHash;
1733
1734
1735 (void) OCSP_id_get0_info(&res_cert_iNameHash, NULL, NULL, &res_cert_serial,
1736 (OCSP_CERTID *) cid);
1737 resp_bn = ASN1_INTEGER_to_BN(res_cert_serial, NULL);
1738
1739 DEBUG(D_tls)
1740 {
1741 debug_printf("cert serial: %s\n", BN_bn2hex(cert_bn));
1742 debug_printf("resp serial: %s\n", BN_bn2hex(resp_bn));
1743 }
1744
1745 if (BN_cmp(cert_bn, resp_bn) == 0)
1746 {
1747 DEBUG(D_tls) debug_printf("matched serial for ocsp\n");
1748
1749 /*XXX TODO: check the rest of the list for duplicate matches.
1750 If any, need to also check the Issuer Name hash.
1751 Without this, we will provide the wrong status in the case of
1752 duplicate id. */
1753
1754 break;
1755 }
1756 DEBUG(D_tls) debug_printf("not match serial for ocsp\n");
1757 }
1758 if (!olist)
1759 {
1760 DEBUG(D_tls) debug_printf("failed to find match for ocsp\n");
1761 return SSL_TLSEXT_ERR_NOACK;
1762 }
1763 }
1764
1765 /*XXX could we do the i2d earlier, rather than during the callback? */
1766 response_der = NULL;
1767 response_der_len = i2d_OCSP_RESPONSE(olist->resp, &response_der);
1768 if (response_der_len <= 0)
1769 return SSL_TLSEXT_ERR_NOACK;
1770
1771 SSL_set_tlsext_status_ocsp_resp(server_ssl, response_der, response_der_len);
1772 tls_in.ocsp = OCSP_VFIED;
1773 return SSL_TLSEXT_ERR_OK;
1774 }
1775
1776
1777 static void
1778 time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
1779 {
1780 BIO_printf(bp, "\t%s: ", str);
1781 ASN1_GENERALIZEDTIME_print(bp, time);
1782 BIO_puts(bp, "\n");
1783 }
1784
1785 static int
1786 tls_client_stapling_cb(SSL *s, void *arg)
1787 {
1788 tls_ext_ctx_cb * cbinfo = arg;
1789 const unsigned char * p;
1790 int len;
1791 OCSP_RESPONSE * rsp;
1792 OCSP_BASICRESP * bs;
1793 int i;
1794
1795 DEBUG(D_tls) debug_printf("Received TLS status response (OCSP stapling):");
1796 len = SSL_get_tlsext_status_ocsp_resp(s, &p);
1797 if(!p)
1798 {
1799 /* Expect this when we requested ocsp but got none */
1800 if (cbinfo->u_ocsp.client.verify_required && LOGGING(tls_cipher))
1801 log_write(0, LOG_MAIN, "Received TLS status callback, null content");
1802 else
1803 DEBUG(D_tls) debug_printf(" null\n");
1804 return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1805 }
1806
1807 if (!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
1808 {
1809 tls_out.ocsp = OCSP_FAILED; /*XXX should use tlsp-> to permit concurrent outbound */
1810 if (LOGGING(tls_cipher))
1811 log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
1812 else
1813 DEBUG(D_tls) debug_printf(" parse error\n");
1814 return 0;
1815 }
1816
1817 if (!(bs = OCSP_response_get1_basic(rsp)))
1818 {
1819 tls_out.ocsp = OCSP_FAILED;
1820 if (LOGGING(tls_cipher))
1821 log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
1822 else
1823 DEBUG(D_tls) debug_printf(" error parsing response\n");
1824 OCSP_RESPONSE_free(rsp);
1825 return 0;
1826 }
1827
1828 /* We'd check the nonce here if we'd put one in the request. */
1829 /* However that would defeat cacheability on the server so we don't. */
1830
1831 /* This section of code reworked from OpenSSL apps source;
1832 The OpenSSL Project retains copyright:
1833 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
1834 */
1835 {
1836 BIO * bp = NULL;
1837 int status, reason;
1838 ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
1839
1840 DEBUG(D_tls) bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
1841
1842 /*OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
1843
1844 /* Use the chain that verified the server cert to verify the stapled info */
1845 /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
1846
1847 if ((i = OCSP_basic_verify(bs, cbinfo->verify_stack,
1848 cbinfo->u_ocsp.client.verify_store, 0)) <= 0)
1849 {
1850 tls_out.ocsp = OCSP_FAILED;
1851 if (LOGGING(tls_cipher)) log_write(0, LOG_MAIN,
1852 "Received TLS cert status response, itself unverifiable: %s",
1853 ERR_reason_error_string(ERR_peek_error()));
1854 BIO_printf(bp, "OCSP response verify failure\n");
1855 ERR_print_errors(bp);
1856 OCSP_RESPONSE_print(bp, rsp, 0);
1857 goto failed;
1858 }
1859
1860 BIO_printf(bp, "OCSP response well-formed and signed OK\n");
1861
1862 /*XXX So we have a good stapled OCSP status. How do we know
1863 it is for the cert of interest? OpenSSL 1.1.0 has a routine
1864 OCSP_resp_find_status() which matches on a cert id, which presumably
1865 we should use. Making an id needs OCSP_cert_id_new(), which takes
1866 issuerName, issuerKey, serialNumber. Are they all in the cert?
1867
1868 For now, carry on blindly accepting the resp. */
1869
1870 {
1871 OCSP_SINGLERESP * single;
1872
1873 #ifdef EXIM_HAVE_OCSP_RESP_COUNT
1874 if (OCSP_resp_count(bs) != 1)
1875 #else
1876 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
1877 if (sk_OCSP_SINGLERESP_num(sresp) != 1)
1878 #endif
1879 {
1880 tls_out.ocsp = OCSP_FAILED;
1881 log_write(0, LOG_MAIN, "OCSP stapling "
1882 "with multiple responses not handled");
1883 goto failed;
1884 }
1885 single = OCSP_resp_get0(bs, 0);
1886 status = OCSP_single_get0_status(single, &reason, &rev,
1887 &thisupd, &nextupd);
1888 }
1889
1890 DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
1891 DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
1892 if (!OCSP_check_validity(thisupd, nextupd,
1893 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1894 {
1895 tls_out.ocsp = OCSP_FAILED;
1896 DEBUG(D_tls) ERR_print_errors(bp);
1897 log_write(0, LOG_MAIN, "Server OSCP dates invalid");
1898 }
1899 else
1900 {
1901 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
1902 OCSP_cert_status_str(status));
1903 switch(status)
1904 {
1905 case V_OCSP_CERTSTATUS_GOOD:
1906 tls_out.ocsp = OCSP_VFIED;
1907 i = 1;
1908 goto good;
1909 case V_OCSP_CERTSTATUS_REVOKED:
1910 tls_out.ocsp = OCSP_FAILED;
1911 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
1912 reason != -1 ? "; reason: " : "",
1913 reason != -1 ? OCSP_crl_reason_str(reason) : "");
1914 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
1915 break;
1916 default:
1917 tls_out.ocsp = OCSP_FAILED;
1918 log_write(0, LOG_MAIN,
1919 "Server certificate status unknown, in OCSP stapling");
1920 break;
1921 }
1922 }
1923 failed:
1924 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1925 good:
1926 BIO_free(bp);
1927 }
1928
1929 OCSP_RESPONSE_free(rsp);
1930 return i;
1931 }
1932 #endif /*!DISABLE_OCSP*/
1933
1934
1935 /*************************************************
1936 * Initialize for TLS *
1937 *************************************************/
1938
1939 /* Called from both server and client code, to do preliminary initialization
1940 of the library. We allocate and return a context structure.
1941
1942 Arguments:
1943 ctxp returned SSL context
1944 host connected host, if client; NULL if server
1945 dhparam DH parameter file
1946 certificate certificate file
1947 privatekey private key
1948 ocsp_file file of stapling info (server); flag for require ocsp (client)
1949 addr address if client; NULL if server (for some randomness)
1950 cbp place to put allocated callback context
1951 errstr error string pointer
1952
1953 Returns: OK/DEFER/FAIL
1954 */
1955
1956 static int
1957 tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate,
1958 uschar *privatekey,
1959 #ifndef DISABLE_OCSP
1960 uschar *ocsp_file,
1961 #endif
1962 address_item *addr, tls_ext_ctx_cb ** cbp,
1963 tls_support * tlsp,
1964 uschar ** errstr)
1965 {
1966 SSL_CTX * ctx;
1967 long init_options;
1968 int rc;
1969 tls_ext_ctx_cb * cbinfo;
1970
1971 cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
1972 cbinfo->tlsp = tlsp;
1973 cbinfo->certificate = certificate;
1974 cbinfo->privatekey = privatekey;
1975 cbinfo->is_server = host==NULL;
1976 #ifndef DISABLE_OCSP
1977 cbinfo->verify_stack = NULL;
1978 if (!host)
1979 {
1980 cbinfo->u_ocsp.server.file = ocsp_file;
1981 cbinfo->u_ocsp.server.file_expanded = NULL;
1982 cbinfo->u_ocsp.server.olist = NULL;
1983 }
1984 else
1985 cbinfo->u_ocsp.client.verify_store = NULL;
1986 #endif
1987 cbinfo->dhparam = dhparam;
1988 cbinfo->server_cipher_list = NULL;
1989 cbinfo->host = host;
1990 #ifndef DISABLE_EVENT
1991 cbinfo->event_action = NULL;
1992 #endif
1993
1994 #ifdef EXIM_NEED_OPENSSL_INIT
1995 SSL_load_error_strings(); /* basic set up */
1996 OpenSSL_add_ssl_algorithms();
1997 #endif
1998
1999 #ifdef EXIM_HAVE_SHA256
2000 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
2001 list of available digests. */
2002 EVP_add_digest(EVP_sha256());
2003 #endif
2004
2005 /* Create a context.
2006 The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
2007 negotiation in the different methods; as far as I can tell, the only
2008 *_{server,client}_method which allows negotiation is SSLv23, which exists even
2009 when OpenSSL is built without SSLv2 support.
2010 By disabling with openssl_options, we can let admins re-enable with the
2011 existing knob. */
2012
2013 #ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
2014 if (!(ctx = SSL_CTX_new(host ? TLS_client_method() : TLS_server_method())))
2015 #else
2016 if (!(ctx = SSL_CTX_new(host ? SSLv23_client_method() : SSLv23_server_method())))
2017 #endif
2018 return tls_error(US"SSL_CTX_new", host, NULL, errstr);
2019
2020 /* It turns out that we need to seed the random number generator this early in
2021 order to get the full complement of ciphers to work. It took me roughly a day
2022 of work to discover this by experiment.
2023
2024 On systems that have /dev/urandom, SSL may automatically seed itself from
2025 there. Otherwise, we have to make something up as best we can. Double check
2026 afterwards. */
2027
2028 if (!RAND_status())
2029 {
2030 randstuff r;
2031 gettimeofday(&r.tv, NULL);
2032 r.p = getpid();
2033
2034 RAND_seed(US (&r), sizeof(r));
2035 RAND_seed(US big_buffer, big_buffer_size);
2036 if (addr != NULL) RAND_seed(US addr, sizeof(addr));
2037
2038 if (!RAND_status())
2039 return tls_error(US"RAND_status", host,
2040 US"unable to seed random number generator", errstr);
2041 }
2042
2043 /* Set up the information callback, which outputs if debugging is at a suitable
2044 level. */
2045
2046 DEBUG(D_tls)
2047 {
2048 SSL_CTX_set_info_callback(ctx, (void (*)())info_callback);
2049 #if defined(EXIM_HAVE_OPESSL_TRACE) && !defined(OPENSSL_NO_SSL_TRACE)
2050 /* this needs a debug build of OpenSSL */
2051 SSL_CTX_set_msg_callback(ctx, (void (*)())SSL_trace);
2052 #endif
2053 #ifdef OPENSSL_HAVE_KEYLOG_CB
2054 SSL_CTX_set_keylog_callback(ctx, (void (*)())keylog_callback);
2055 #endif
2056 }
2057
2058 /* Automatically re-try reads/writes after renegotiation. */
2059 (void) SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
2060
2061 /* Apply administrator-supplied work-arounds.
2062 Historically we applied just one requested option,
2063 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
2064 moved to an administrator-controlled list of options to specify and
2065 grandfathered in the first one as the default value for "openssl_options".
2066
2067 No OpenSSL version number checks: the options we accept depend upon the
2068 availability of the option value macros from OpenSSL. */
2069
2070 if (!tls_openssl_options_parse(openssl_options, &init_options))
2071 return tls_error(US"openssl_options parsing failed", host, NULL, errstr);
2072
2073 #ifdef EXPERIMENTAL_TLS_RESUME
2074 tlsp->resumption = RESUME_SUPPORTED;
2075 #endif
2076 if (init_options)
2077 {
2078 #ifdef EXPERIMENTAL_TLS_RESUME
2079 /* Should the server offer session resumption? */
2080 if (!host && verify_check_host(&tls_resumption_hosts) == OK)
2081 {
2082 DEBUG(D_tls) debug_printf("tls_resumption_hosts overrides openssl_options\n");
2083 init_options &= ~SSL_OP_NO_TICKET;
2084 tlsp->resumption |= RESUME_SERVER_TICKET; /* server will give ticket on request */
2085 tlsp->host_resumable = TRUE;
2086 }
2087 #endif
2088
2089 DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
2090 if (!(SSL_CTX_set_options(ctx, init_options)))
2091 return tls_error(string_sprintf(
2092 "SSL_CTX_set_option(%#lx)", init_options), host, NULL, errstr);
2093 }
2094 else
2095 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
2096
2097 /* We'd like to disable session cache unconditionally, but foolish Outlook
2098 Express clients then give up the first TLS connection and make a second one
2099 (which works). Only when there is an IMAP service on the same machine.
2100 Presumably OE is trying to use the cache for A on B. Leave it enabled for
2101 now, until we work out a decent way of presenting control to the config. It
2102 will never be used because we use a new context every time. */
2103 #ifdef notdef
2104 (void) SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
2105 #endif
2106
2107 /* Initialize with DH parameters if supplied */
2108 /* Initialize ECDH temp key parameter selection */
2109
2110 if ( !init_dh(ctx, dhparam, host, errstr)
2111 || !init_ecdh(ctx, host, errstr)
2112 )
2113 return DEFER;
2114
2115 /* Set up certificate and key (and perhaps OCSP info) */
2116
2117 if ((rc = tls_expand_session_files(ctx, cbinfo, errstr)) != OK)
2118 return rc;
2119
2120 /* If we need to handle SNI or OCSP, do so */
2121
2122 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2123 # ifndef DISABLE_OCSP
2124 if (!(cbinfo->verify_stack = sk_X509_new_null()))
2125 {
2126 DEBUG(D_tls) debug_printf("failed to create stack for stapling verify\n");
2127 return FAIL;
2128 }
2129 # endif
2130
2131 if (!host) /* server */
2132 {
2133 # ifndef DISABLE_OCSP
2134 /* We check u_ocsp.server.file, not server.olist, because we care about if
2135 the option exists, not what the current expansion might be, as SNI might
2136 change the certificate and OCSP file in use between now and the time the
2137 callback is invoked. */
2138 if (cbinfo->u_ocsp.server.file)
2139 {
2140 SSL_CTX_set_tlsext_status_cb(ctx, tls_server_stapling_cb);
2141 SSL_CTX_set_tlsext_status_arg(ctx, cbinfo);
2142 }
2143 # endif
2144 /* We always do this, so that $tls_sni is available even if not used in
2145 tls_certificate */
2146 SSL_CTX_set_tlsext_servername_callback(ctx, tls_servername_cb);
2147 SSL_CTX_set_tlsext_servername_arg(ctx, cbinfo);
2148 }
2149 # ifndef DISABLE_OCSP
2150 else /* client */
2151 if(ocsp_file) /* wanting stapling */
2152 {
2153 if (!(cbinfo->u_ocsp.client.verify_store = X509_STORE_new()))
2154 {
2155 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
2156 return FAIL;
2157 }
2158 SSL_CTX_set_tlsext_status_cb(ctx, tls_client_stapling_cb);
2159 SSL_CTX_set_tlsext_status_arg(ctx, cbinfo);
2160 }
2161 # endif
2162 #endif
2163
2164 cbinfo->verify_cert_hostnames = NULL;
2165
2166 #ifdef EXIM_HAVE_EPHEM_RSA_KEX
2167 /* Set up the RSA callback */
2168 SSL_CTX_set_tmp_rsa_callback(ctx, rsa_callback);
2169 #endif
2170
2171 /* Finally, set the session cache timeout, and we are done.
2172 The period appears to be also used for (server-generated) session tickets */
2173
2174 SSL_CTX_set_timeout(ctx, ssl_session_timeout);
2175 DEBUG(D_tls) debug_printf("Initialized TLS\n");
2176
2177 *cbp = cbinfo;
2178 *ctxp = ctx;
2179
2180 return OK;
2181 }
2182
2183
2184
2185
2186 /*************************************************
2187 * Get name of cipher in use *
2188 *************************************************/
2189
2190 /*
2191 Argument: pointer to an SSL structure for the connection
2192 pointer to number of bits for cipher
2193 Returns: pointer to allocated string in perm-pool
2194 */
2195
2196 static uschar *
2197 construct_cipher_name(SSL * ssl, int * bits)
2198 {
2199 int pool = store_pool;
2200 /* With OpenSSL 1.0.0a, 'c' needs to be const but the documentation doesn't
2201 yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
2202 the accessor functions use const in the prototype. */
2203
2204 const uschar * ver = CUS SSL_get_version(ssl);
2205 const SSL_CIPHER * c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
2206 uschar * s;
2207
2208 SSL_CIPHER_get_bits(c, bits);
2209
2210 store_pool = POOL_PERM;
2211 s = string_sprintf("%s:%s:%u", ver, SSL_CIPHER_get_name(c), *bits);
2212 store_pool = pool;
2213 DEBUG(D_tls) debug_printf("Cipher: %s\n", s);
2214 return s;
2215 }
2216
2217
2218 /* Get IETF-standard name for ciphersuite.
2219 Argument: pointer to an SSL structure for the connection
2220 Returns: pointer to string
2221 */
2222
2223 static const uschar *
2224 cipher_stdname_ssl(SSL * ssl)
2225 {
2226 #ifdef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
2227 return CUS SSL_CIPHER_standard_name(SSL_get_current_cipher(ssl));
2228 #else
2229 ushort id = 0xffff & SSL_CIPHER_get_id(SSL_get_current_cipher(ssl));
2230 return cipher_stdname(id >> 8, id & 0xff);
2231 #endif
2232 }
2233
2234
2235 static void
2236 peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned siz)
2237 {
2238 /*XXX we might consider a list-of-certs variable for the cert chain.
2239 SSL_get_peer_cert_chain(SSL*). We'd need a new variable type and support
2240 in list-handling functions, also consider the difference between the entire
2241 chain and the elements sent by the peer. */
2242
2243 tlsp->peerdn = NULL;
2244
2245 /* Will have already noted peercert on a verify fail; possibly not the leaf */
2246 if (!tlsp->peercert)
2247 tlsp->peercert = SSL_get_peer_certificate(ssl);
2248 /* Beware anonymous ciphers which lead to server_cert being NULL */
2249 if (tlsp->peercert)
2250 if (!X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, siz))
2251 { DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n"); }
2252 else
2253 {
2254 int oldpool = store_pool;
2255
2256 peerdn[siz-1] = '\0'; /* paranoia */
2257 store_pool = POOL_PERM;
2258 tlsp->peerdn = string_copy(peerdn);
2259 store_pool = oldpool;
2260
2261 /* We used to set CV in the cert-verify callbacks (either plain or dane)
2262 but they don't get called on session-resumption. So use the official
2263 interface, which uses the resumed value. Unfortunately this claims verified
2264 when it actually failed but we're in try-verify mode, due to us wanting the
2265 knowlege that it failed so needing to have the callback and forcing a
2266 permissive return. If we don't force it, the TLS startup is failed.
2267 The extra bit of information is set in verify_override in the cb, stashed
2268 for resumption next to the TLS session, and used here. */
2269
2270 if (!tlsp->verify_override)
2271 tlsp->certificate_verified = SSL_get_verify_result(ssl) == X509_V_OK;
2272 }
2273 }
2274
2275
2276
2277
2278
2279 /*************************************************
2280 * Set up for verifying certificates *
2281 *************************************************/
2282
2283 #ifndef DISABLE_OCSP
2284 /* Load certs from file, return TRUE on success */
2285
2286 static BOOL
2287 chain_from_pem_file(const uschar * file, STACK_OF(X509) * verify_stack)
2288 {
2289 BIO * bp;
2290 X509 * x;
2291
2292 while (sk_X509_num(verify_stack) > 0)
2293 X509_free(sk_X509_pop(verify_stack));
2294
2295 if (!(bp = BIO_new_file(CS file, "r"))) return FALSE;
2296 while ((x = PEM_read_bio_X509(bp, NULL, 0, NULL)))
2297 sk_X509_push(verify_stack, x);
2298 BIO_free(bp);
2299 return TRUE;
2300 }
2301 #endif
2302
2303
2304
2305 /* Called by both client and server startup; on the server possibly
2306 repeated after a Server Name Indication.
2307
2308 Arguments:
2309 sctx SSL_CTX* to initialise
2310 certs certs file or NULL
2311 crl CRL file or NULL
2312 host NULL in a server; the remote host in a client
2313 optional TRUE if called from a server for a host in tls_try_verify_hosts;
2314 otherwise passed as FALSE
2315 cert_vfy_cb Callback function for certificate verification
2316 errstr error string pointer
2317
2318 Returns: OK/DEFER/FAIL
2319 */
2320
2321 static int
2322 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
2323 int (*cert_vfy_cb)(int, X509_STORE_CTX *), uschar ** errstr)
2324 {
2325 uschar *expcerts, *expcrl;
2326
2327 if (!expand_check(certs, US"tls_verify_certificates", &expcerts, errstr))
2328 return DEFER;
2329 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
2330
2331 if (expcerts && *expcerts)
2332 {
2333 /* Tell the library to use its compiled-in location for the system default
2334 CA bundle. Then add the ones specified in the config, if any. */
2335
2336 if (!SSL_CTX_set_default_verify_paths(sctx))
2337 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL, errstr);
2338
2339 if (Ustrcmp(expcerts, "system") != 0)
2340 {
2341 struct stat statbuf;
2342
2343 if (Ustat(expcerts, &statbuf) < 0)
2344 {
2345 log_write(0, LOG_MAIN|LOG_PANIC,
2346 "failed to stat %s for certificates", expcerts);
2347 return DEFER;
2348 }
2349 else
2350 {
2351 uschar *file, *dir;
2352 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
2353 { file = NULL; dir = expcerts; }
2354 else
2355 {
2356 file = expcerts; dir = NULL;
2357 #ifndef DISABLE_OCSP
2358 /* In the server if we will be offering an OCSP proof, load chain from
2359 file for verifying the OCSP proof at load time. */
2360
2361 /*XXX Glitch! The file here is tls_verify_certs: the chain for verifying the client cert.
2362 This is inconsistent with the need to verify the OCSP proof of the server cert.
2363 */
2364
2365 if ( !host
2366 && statbuf.st_size > 0
2367 && server_static_cbinfo->u_ocsp.server.file
2368 && !chain_from_pem_file(file, server_static_cbinfo->verify_stack)
2369 )
2370 {
2371 log_write(0, LOG_MAIN|LOG_PANIC,
2372 "failed to load cert chain from %s", file);
2373 return DEFER;
2374 }
2375 #endif
2376 }
2377
2378 /* If a certificate file is empty, the next function fails with an
2379 unhelpful error message. If we skip it, we get the correct behaviour (no
2380 certificates are recognized, but the error message is still misleading (it
2381 says no certificate was supplied). But this is better. */
2382
2383 if ( (!file || statbuf.st_size > 0)
2384 && !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
2385 return tls_error(US"SSL_CTX_load_verify_locations", host, NULL, errstr);
2386
2387 /* Load the list of CAs for which we will accept certs, for sending
2388 to the client. This is only for the one-file tls_verify_certificates
2389 variant.
2390 If a list isn't loaded into the server, but some verify locations are set,
2391 the server end appears to make a wildcard request for client certs.
2392 Meanwhile, the client library as default behaviour *ignores* the list
2393 we send over the wire - see man SSL_CTX_set_client_cert_cb.
2394 Because of this, and that the dir variant is likely only used for
2395 the public-CA bundle (not for a private CA), not worth fixing. */
2396
2397 if (file)
2398 {
2399 STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
2400
2401 SSL_CTX_set_client_CA_list(sctx, names);
2402 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n",
2403 sk_X509_NAME_num(names));
2404 }
2405 }
2406 }
2407
2408 /* Handle a certificate revocation list. */
2409
2410 #if OPENSSL_VERSION_NUMBER > 0x00907000L
2411
2412 /* This bit of code is now the version supplied by Lars Mainka. (I have
2413 merely reformatted it into the Exim code style.)
2414
2415 "From here I changed the code to add support for multiple crl's
2416 in pem format in one file or to support hashed directory entries in
2417 pem format instead of a file. This method now uses the library function
2418 X509_STORE_load_locations to add the CRL location to the SSL context.
2419 OpenSSL will then handle the verify against CA certs and CRLs by
2420 itself in the verify callback." */
2421
2422 if (!expand_check(crl, US"tls_crl", &expcrl, errstr)) return DEFER;
2423 if (expcrl && *expcrl)
2424 {
2425 struct stat statbufcrl;
2426 if (Ustat(expcrl, &statbufcrl) < 0)
2427 {
2428 log_write(0, LOG_MAIN|LOG_PANIC,
2429 "failed to stat %s for certificates revocation lists", expcrl);
2430 return DEFER;
2431 }
2432 else
2433 {
2434 /* is it a file or directory? */
2435 uschar *file, *dir;
2436 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
2437 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
2438 {
2439 file = NULL;
2440 dir = expcrl;
2441 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
2442 }
2443 else
2444 {
2445 file = expcrl;
2446 dir = NULL;
2447 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
2448 }
2449 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
2450 return tls_error(US"X509_STORE_load_locations", host, NULL, errstr);
2451
2452 /* setting the flags to check against the complete crl chain */
2453
2454 X509_STORE_set_flags(cvstore,
2455 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
2456 }
2457 }
2458
2459 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
2460
2461 /* If verification is optional, don't fail if no certificate */
2462
2463 SSL_CTX_set_verify(sctx,
2464 SSL_VERIFY_PEER | (optional ? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
2465 cert_vfy_cb);
2466 }
2467
2468 return OK;
2469 }
2470
2471
2472
2473 /*************************************************
2474 * Start a TLS session in a server *
2475 *************************************************/
2476
2477 /* This is called when Exim is running as a server, after having received
2478 the STARTTLS command. It must respond to that command, and then negotiate
2479 a TLS session.
2480
2481 Arguments:
2482 require_ciphers allowed ciphers
2483 errstr pointer to error message
2484
2485 Returns: OK on success
2486 DEFER for errors before the start of the negotiation
2487 FAIL for errors during the negotiation; the server can't
2488 continue running.
2489 */
2490
2491 int
2492 tls_server_start(const uschar * require_ciphers, uschar ** errstr)
2493 {
2494 int rc;
2495 uschar * expciphers;
2496 tls_ext_ctx_cb * cbinfo;
2497 static uschar peerdn[256];
2498
2499 /* Check for previous activation */
2500
2501 if (tls_in.active.sock >= 0)
2502 {
2503 tls_error(US"STARTTLS received after TLS started", NULL, US"", errstr);
2504 smtp_printf("554 Already in TLS\r\n", FALSE);
2505 return FAIL;
2506 }
2507
2508 /* Initialize the SSL library. If it fails, it will already have logged
2509 the error. */
2510
2511 rc = tls_init(&server_ctx, NULL, tls_dhparam, tls_certificate, tls_privatekey,
2512 #ifndef DISABLE_OCSP
2513 tls_ocsp_file,
2514 #endif
2515 NULL, &server_static_cbinfo, &tls_in, errstr);
2516 if (rc != OK) return rc;
2517 cbinfo = server_static_cbinfo;
2518
2519 if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers, errstr))
2520 return FAIL;
2521
2522 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
2523 were historically separated by underscores. So that I can use either form in my
2524 tests, and also for general convenience, we turn underscores into hyphens here.
2525
2526 XXX SSL_CTX_set_cipher_list() is replaced by SSL_CTX_set_ciphersuites()
2527 for TLS 1.3 . Since we do not call it at present we get the default list:
2528 TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
2529 */
2530
2531 if (expciphers)
2532 {
2533 for (uschar * s = expciphers; *s; s++ ) if (*s == '_') *s = '-';
2534 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
2535 if (!SSL_CTX_set_cipher_list(server_ctx, CS expciphers))
2536 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL, errstr);
2537 cbinfo->server_cipher_list = expciphers;
2538 }
2539
2540 /* If this is a host for which certificate verification is mandatory or
2541 optional, set up appropriately. */
2542
2543 tls_in.certificate_verified = FALSE;
2544 #ifdef SUPPORT_DANE
2545 tls_in.dane_verified = FALSE;
2546 #endif
2547 server_verify_callback_called = FALSE;
2548
2549 if (verify_check_host(&tls_verify_hosts) == OK)
2550 {
2551 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
2552 FALSE, verify_callback_server, errstr);
2553 if (rc != OK) return rc;
2554 server_verify_optional = FALSE;
2555 }
2556 else if (verify_check_host(&tls_try_verify_hosts) == OK)
2557 {
2558 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
2559 TRUE, verify_callback_server, errstr);
2560 if (rc != OK) return rc;
2561 server_verify_optional = TRUE;
2562 }
2563
2564 #ifdef EXPERIMENTAL_TLS_RESUME
2565 SSL_CTX_set_tlsext_ticket_key_cb(server_ctx, ticket_key_callback);
2566 /* despite working, appears to always return failure, so ignoring */
2567 #endif
2568 #ifdef OPENSSL_HAVE_NUM_TICKETS
2569 # ifdef EXPERIMENTAL_TLS_RESUME
2570 SSL_CTX_set_num_tickets(server_ctx, tls_in.host_resumable ? 1 : 0);
2571 # else
2572 SSL_CTX_set_num_tickets(server_ctx, 0); /* send no TLS1.3 stateful-tickets */
2573 # endif
2574 #endif
2575
2576
2577 /* Prepare for new connection */
2578
2579 if (!(server_ssl = SSL_new(server_ctx)))
2580 return tls_error(US"SSL_new", NULL, NULL, errstr);
2581
2582 /* Warning: we used to SSL_clear(ssl) here, it was removed.
2583 *
2584 * With the SSL_clear(), we get strange interoperability bugs with
2585 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
2586 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
2587 *
2588 * The SSL_clear() call is to let an existing SSL* be reused, typically after
2589 * session shutdown. In this case, we have a brand new object and there's no
2590 * obvious reason to immediately clear it. I'm guessing that this was
2591 * originally added because of incomplete initialisation which the clear fixed,
2592 * in some historic release.
2593 */
2594
2595 /* Set context and tell client to go ahead, except in the case of TLS startup
2596 on connection, where outputting anything now upsets the clients and tends to
2597 make them disconnect. We need to have an explicit fflush() here, to force out
2598 the response. Other smtp_printf() calls do not need it, because in non-TLS
2599 mode, the fflush() happens when smtp_getc() is called. */
2600
2601 SSL_set_session_id_context(server_ssl, sid_ctx, Ustrlen(sid_ctx));
2602 if (!tls_in.on_connect)
2603 {
2604 smtp_printf("220 TLS go ahead\r\n", FALSE);
2605 fflush(smtp_out);
2606 }
2607
2608 /* Now negotiate the TLS session. We put our own timer on it, since it seems
2609 that the OpenSSL library doesn't. */
2610
2611 SSL_set_wfd(server_ssl, fileno(smtp_out));
2612 SSL_set_rfd(server_ssl, fileno(smtp_in));
2613 SSL_set_accept_state(server_ssl);
2614
2615 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
2616
2617 sigalrm_seen = FALSE;
2618 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
2619 rc = SSL_accept(server_ssl);
2620 ALARM_CLR(0);
2621
2622 if (rc <= 0)
2623 {
2624 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
2625 return FAIL;
2626 }
2627
2628 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
2629 ERR_clear_error(); /* Even success can leave errors in the stack. Seen with
2630 anon-authentication ciphersuite negotiated. */
2631
2632 #ifdef EXPERIMENTAL_TLS_RESUME
2633 if (SSL_session_reused(server_ssl))
2634 {
2635 tls_in.resumption |= RESUME_USED;
2636 DEBUG(D_tls) debug_printf("Session reused\n");
2637 }
2638 #endif
2639
2640 /* TLS has been set up. Adjust the input functions to read via TLS,
2641 and initialize things. */
2642
2643 peer_cert(server_ssl, &tls_in, peerdn, sizeof(peerdn));
2644
2645 tls_in.cipher = construct_cipher_name(server_ssl, &tls_in.bits);
2646 tls_in.cipher_stdname = cipher_stdname_ssl(server_ssl);
2647
2648 DEBUG(D_tls)
2649 {
2650 uschar buf[2048];
2651 if (SSL_get_shared_ciphers(server_ssl, CS buf, sizeof(buf)))
2652 debug_printf("Shared ciphers: %s\n", buf);
2653
2654 #ifdef EXIM_HAVE_OPENSSL_KEYLOG
2655 {
2656 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
2657 SSL_SESSION_print_keylog(bp, SSL_get_session(server_ssl));
2658 BIO_free(bp);
2659 }
2660 #endif
2661
2662 #ifdef EXIM_HAVE_SESSION_TICKET
2663 {
2664 SSL_SESSION * ss = SSL_get_session(server_ssl);
2665 if (SSL_SESSION_has_ticket(ss)) /* 1.1.0 */
2666 debug_printf("The session has a ticket, life %lu seconds\n",
2667 SSL_SESSION_get_ticket_lifetime_hint(ss));
2668 }
2669 #endif
2670 }
2671
2672 /* Record the certificate we presented */
2673 {
2674 X509 * crt = SSL_get_certificate(server_ssl);
2675 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
2676 }
2677
2678 /* Only used by the server-side tls (tls_in), including tls_getc.
2679 Client-side (tls_out) reads (seem to?) go via
2680 smtp_read_response()/ip_recv().
2681 Hence no need to duplicate for _in and _out.
2682 */
2683 if (!ssl_xfer_buffer) ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
2684 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
2685 ssl_xfer_eof = ssl_xfer_error = FALSE;
2686
2687 receive_getc = tls_getc;
2688 receive_getbuf = tls_getbuf;
2689 receive_get_cache = tls_get_cache;
2690 receive_ungetc = tls_ungetc;
2691 receive_feof = tls_feof;
2692 receive_ferror = tls_ferror;
2693 receive_smtp_buffered = tls_smtp_buffered;
2694
2695 tls_in.active.sock = fileno(smtp_out);
2696 tls_in.active.tls_ctx = NULL; /* not using explicit ctx for server-side */
2697 return OK;
2698 }
2699
2700
2701
2702
2703 static int
2704 tls_client_basic_ctx_init(SSL_CTX * ctx,
2705 host_item * host, smtp_transport_options_block * ob, tls_ext_ctx_cb * cbinfo,
2706 uschar ** errstr)
2707 {
2708 int rc;
2709 /* stick to the old behaviour for compatibility if tls_verify_certificates is
2710 set but both tls_verify_hosts and tls_try_verify_hosts is not set. Check only
2711 the specified host patterns if one of them is defined */
2712
2713 if ( ( !ob->tls_verify_hosts
2714 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2715 )
2716 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
2717 )
2718 client_verify_optional = FALSE;
2719 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
2720 client_verify_optional = TRUE;
2721 else
2722 return OK;
2723
2724 if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
2725 ob->tls_crl, host, client_verify_optional, verify_callback_client,
2726 errstr)) != OK)
2727 return rc;
2728
2729 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
2730 {
2731 cbinfo->verify_cert_hostnames =
2732 #ifdef SUPPORT_I18N
2733 string_domain_utf8_to_alabel(host->name, NULL);
2734 #else
2735 host->name;
2736 #endif
2737 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
2738 cbinfo->verify_cert_hostnames);
2739 }
2740 return OK;
2741 }
2742
2743
2744 #ifdef SUPPORT_DANE
2745 static int
2746 dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa, uschar ** errstr)
2747 {
2748 dns_scan dnss;
2749 const char * hostnames[2] = { CS host->name, NULL };
2750 int found = 0;
2751
2752 if (DANESSL_init(ssl, NULL, hostnames) != 1)
2753 return tls_error(US"hostnames load", host, NULL, errstr);
2754
2755 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
2756 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2757 ) if (rr->type == T_TLSA && rr->size > 3)
2758 {
2759 const uschar * p = rr->data;
2760 uint8_t usage, selector, mtype;
2761 const char * mdname;
2762
2763 usage = *p++;
2764
2765 /* Only DANE-TA(2) and DANE-EE(3) are supported */
2766 if (usage != 2 && usage != 3) continue;
2767
2768 selector = *p++;
2769 mtype = *p++;
2770
2771 switch (mtype)
2772 {
2773 default: continue; /* Only match-types 0, 1, 2 are supported */
2774 case 0: mdname = NULL; break;
2775 case 1: mdname = "sha256"; break;
2776 case 2: mdname = "sha512"; break;
2777 }
2778
2779 found++;
2780 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
2781 {
2782 default:
2783 return tls_error(US"tlsa load", host, NULL, errstr);
2784 case 0: /* action not taken */
2785 case 1: break;
2786 }
2787
2788 tls_out.tlsa_usage |= 1<<usage;
2789 }
2790
2791 if (found)
2792 return OK;
2793
2794 log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
2795 return DEFER;
2796 }
2797 #endif /*SUPPORT_DANE*/
2798
2799
2800
2801 #ifdef EXPERIMENTAL_TLS_RESUME
2802 /* On the client, get any stashed session for the given IP from hints db
2803 and apply it to the ssl-connection for attempted resumption. */
2804
2805 static void
2806 tls_retrieve_session(tls_support * tlsp, SSL * ssl, const uschar * key)
2807 {
2808 tlsp->resumption |= RESUME_SUPPORTED;
2809 if (tlsp->host_resumable)
2810 {
2811 dbdata_tls_session * dt;
2812 int len;
2813 open_db dbblock, * dbm_file;
2814
2815 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
2816 DEBUG(D_tls) debug_printf("checking for resumable session for %s\n", key);
2817 if ((dbm_file = dbfn_open(US"tls", O_RDONLY, &dbblock, FALSE, FALSE)))
2818 {
2819 /* key for the db is the IP */
2820 if ((dt = dbfn_read_with_length(dbm_file, key, &len)))
2821 {
2822 SSL_SESSION * ss = NULL;
2823 const uschar * sess_asn1 = dt->session;
2824
2825 len -= sizeof(dbdata_tls_session);
2826 if (!(d2i_SSL_SESSION(&ss, &sess_asn1, (long)len)))
2827 {
2828 DEBUG(D_tls)
2829 {
2830 ERR_error_string_n(ERR_get_error(),
2831 ssl_errstring, sizeof(ssl_errstring));
2832 debug_printf("decoding session: %s\n", ssl_errstring);
2833 }
2834 }
2835 #ifdef EXIM_HAVE_SESSION_TICKET
2836 else if ( SSL_SESSION_get_ticket_lifetime_hint(ss) + dt->time_stamp
2837 < time(NULL))
2838 {
2839 DEBUG(D_tls) debug_printf("session expired\n");
2840 dbfn_delete(dbm_file, key);
2841 }
2842 #endif
2843 else if (!SSL_set_session(ssl, ss))
2844 {
2845 DEBUG(D_tls)
2846 {
2847 ERR_error_string_n(ERR_get_error(),
2848 ssl_errstring, sizeof(ssl_errstring));
2849 debug_printf("applying session to ssl: %s\n", ssl_errstring);
2850 }
2851 }
2852 else
2853 {
2854 DEBUG(D_tls) debug_printf("good session\n");
2855 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
2856 tlsp->verify_override = dt->verify_override;
2857 tlsp->ocsp = dt->ocsp;
2858 }
2859 }
2860 else
2861 DEBUG(D_tls) debug_printf("no session record\n");
2862 dbfn_close(dbm_file);
2863 }
2864 }
2865 }
2866
2867
2868 /* On the client, save the session for later resumption */
2869
2870 static int
2871 tls_save_session_cb(SSL * ssl, SSL_SESSION * ss)
2872 {
2873 tls_ext_ctx_cb * cbinfo = SSL_get_ex_data(ssl, tls_exdata_idx);
2874 tls_support * tlsp;
2875
2876 DEBUG(D_tls) debug_printf("tls_save_session_cb\n");
2877
2878 if (!cbinfo || !(tlsp = cbinfo->tlsp)->host_resumable) return 0;
2879
2880 # ifdef OPENSSL_HAVE_NUM_TICKETS
2881 if (SSL_SESSION_is_resumable(ss)) /* 1.1.1 */
2882 # endif
2883 {
2884 int len = i2d_SSL_SESSION(ss, NULL);
2885 int dlen = sizeof(dbdata_tls_session) + len;
2886 dbdata_tls_session * dt = store_get(dlen, TRUE);
2887 uschar * s = dt->session;
2888 open_db dbblock, * dbm_file;
2889
2890 DEBUG(D_tls) debug_printf("session is resumable\n");
2891 tlsp->resumption |= RESUME_SERVER_TICKET; /* server gave us a ticket */
2892
2893 dt->verify_override = tlsp->verify_override;
2894 dt->ocsp = tlsp->ocsp;
2895 (void) i2d_SSL_SESSION(ss, &s); /* s gets bumped to end */
2896
2897 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
2898 {
2899 const uschar * key = cbinfo->host->address;
2900 dbfn_delete(dbm_file, key);
2901 dbfn_write(dbm_file, key, dt, dlen);
2902 dbfn_close(dbm_file);
2903 DEBUG(D_tls) debug_printf("wrote session (len %u) to db\n",
2904 (unsigned)dlen);
2905 }
2906 }
2907 return 1;
2908 }
2909
2910
2911 static void
2912 tls_client_ctx_resume_prehandshake(
2913 exim_openssl_client_tls_ctx * exim_client_ctx, tls_support * tlsp,
2914 smtp_transport_options_block * ob, host_item * host)
2915 {
2916 /* Should the client request a session resumption ticket? */
2917 if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
2918 {
2919 tlsp->host_resumable = TRUE;
2920
2921 SSL_CTX_set_session_cache_mode(exim_client_ctx->ctx,
2922 SSL_SESS_CACHE_CLIENT
2923 | SSL_SESS_CACHE_NO_INTERNAL | SSL_SESS_CACHE_NO_AUTO_CLEAR);
2924 SSL_CTX_sess_set_new_cb(exim_client_ctx->ctx, tls_save_session_cb);
2925 }
2926 }
2927
2928 static BOOL
2929 tls_client_ssl_resume_prehandshake(SSL * ssl, tls_support * tlsp,
2930 host_item * host, uschar ** errstr)
2931 {
2932 if (tlsp->host_resumable)
2933 {
2934 DEBUG(D_tls)
2935 debug_printf("tls_resumption_hosts overrides openssl_options, enabling tickets\n");
2936 SSL_clear_options(ssl, SSL_OP_NO_TICKET);
2937
2938 tls_exdata_idx = SSL_get_ex_new_index(0, 0, 0, 0, 0);
2939 if (!SSL_set_ex_data(ssl, tls_exdata_idx, client_static_cbinfo))
2940 {
2941 tls_error(US"set ex_data", host, NULL, errstr);
2942 return FALSE;
2943 }
2944 debug_printf("tls_exdata_idx %d cbinfo %p\n", tls_exdata_idx, client_static_cbinfo);
2945 }
2946
2947 tlsp->resumption = RESUME_SUPPORTED;
2948 /* Pick up a previous session, saved on an old ticket */
2949 tls_retrieve_session(tlsp, ssl, host->address);
2950 return TRUE;
2951 }
2952
2953 static void
2954 tls_client_resume_posthandshake(exim_openssl_client_tls_ctx * exim_client_ctx,
2955 tls_support * tlsp)
2956 {
2957 if (SSL_session_reused(exim_client_ctx->ssl))
2958 {
2959 DEBUG(D_tls) debug_printf("The session was reused\n");
2960 tlsp->resumption |= RESUME_USED;
2961 }
2962 }
2963 #endif /* EXPERIMENTAL_TLS_RESUME */
2964
2965
2966 /*************************************************
2967 * Start a TLS session in a client *
2968 *************************************************/
2969
2970 /* Called from the smtp transport after STARTTLS has been accepted.
2971
2972 Arguments:
2973 cctx connection context
2974 conn_args connection details
2975 cookie datum for randomness; can be NULL
2976 tlsp record details of TLS channel configuration here; must be non-NULL
2977 errstr error string pointer
2978
2979 Returns: TRUE for success with TLS session context set in connection context,
2980 FALSE on error
2981 */
2982
2983 BOOL
2984 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
2985 void * cookie, tls_support * tlsp, uschar ** errstr)
2986 {
2987 host_item * host = conn_args->host; /* for msgs and option-tests */
2988 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
2989 smtp_transport_options_block * ob = tb
2990 ? (smtp_transport_options_block *)tb->options_block
2991 : &smtp_transport_option_defaults;
2992 exim_openssl_client_tls_ctx * exim_client_ctx;
2993 uschar * expciphers;
2994 int rc;
2995 static uschar peerdn[256];
2996
2997 #ifndef DISABLE_OCSP
2998 BOOL request_ocsp = FALSE;
2999 BOOL require_ocsp = FALSE;
3000 #endif
3001
3002 rc = store_pool;
3003 store_pool = POOL_PERM;
3004 exim_client_ctx = store_get(sizeof(exim_openssl_client_tls_ctx), FALSE);
3005 exim_client_ctx->corked = NULL;
3006 store_pool = rc;
3007
3008 #ifdef SUPPORT_DANE
3009 tlsp->tlsa_usage = 0;
3010 #endif
3011
3012 #ifndef DISABLE_OCSP
3013 {
3014 # ifdef SUPPORT_DANE
3015 if ( conn_args->dane
3016 && ob->hosts_request_ocsp[0] == '*'
3017 && ob->hosts_request_ocsp[1] == '\0'
3018 )
3019 {
3020 /* Unchanged from default. Use a safer one under DANE */
3021 request_ocsp = TRUE;
3022 ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
3023 " {= {4}{$tls_out_tlsa_usage}} } "
3024 " {*}{}}";
3025 }
3026 # endif
3027
3028 if ((require_ocsp =
3029 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK))
3030 request_ocsp = TRUE;
3031 else
3032 # ifdef SUPPORT_DANE
3033 if (!request_ocsp)
3034 # endif
3035 request_ocsp =
3036 verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
3037 }
3038 #endif
3039
3040 rc = tls_init(&exim_client_ctx->ctx, host, NULL,
3041 ob->tls_certificate, ob->tls_privatekey,
3042 #ifndef DISABLE_OCSP
3043 (void *)(long)request_ocsp,
3044 #endif
3045 cookie, &client_static_cbinfo, tlsp, errstr);
3046 if (rc != OK) return FALSE;
3047
3048 tlsp->certificate_verified = FALSE;
3049 client_verify_callback_called = FALSE;
3050
3051 expciphers = NULL;
3052 #ifdef SUPPORT_DANE
3053 if (conn_args->dane)
3054 {
3055 /* We fall back to tls_require_ciphers if unset, empty or forced failure, but
3056 other failures should be treated as problems. */
3057 if (ob->dane_require_tls_ciphers &&
3058 !expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
3059 &expciphers, errstr))
3060 return FALSE;
3061 if (expciphers && *expciphers == '\0')
3062 expciphers = NULL;
3063 }
3064 #endif
3065 if (!expciphers &&
3066 !expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
3067 &expciphers, errstr))
3068 return FALSE;
3069
3070 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
3071 are separated by underscores. So that I can use either form in my tests, and
3072 also for general convenience, we turn underscores into hyphens here. */
3073
3074 if (expciphers)
3075 {
3076 uschar *s = expciphers;
3077 while (*s) { if (*s == '_') *s = '-'; s++; }
3078 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
3079 if (!SSL_CTX_set_cipher_list(exim_client_ctx->ctx, CS expciphers))
3080 {
3081 tls_error(US"SSL_CTX_set_cipher_list", host, NULL, errstr);
3082 return FALSE;
3083 }
3084 }
3085
3086 #ifdef SUPPORT_DANE
3087 if (conn_args->dane)
3088 {
3089 SSL_CTX_set_verify(exim_client_ctx->ctx,
3090 SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
3091 verify_callback_client_dane);
3092
3093 if (!DANESSL_library_init())
3094 {
3095 tls_error(US"library init", host, NULL, errstr);
3096 return FALSE;
3097 }
3098 if (DANESSL_CTX_init(exim_client_ctx->ctx) <= 0)
3099 {
3100 tls_error(US"context init", host, NULL, errstr);
3101 return FALSE;
3102 }
3103 }
3104 else
3105
3106 #endif
3107
3108 if (tls_client_basic_ctx_init(exim_client_ctx->ctx, host, ob,
3109 client_static_cbinfo, errstr) != OK)
3110 return FALSE;
3111
3112 #ifdef EXPERIMENTAL_TLS_RESUME
3113 tls_client_ctx_resume_prehandshake(exim_client_ctx, tlsp, ob, host);
3114 #endif
3115
3116
3117 if (!(exim_client_ctx->ssl = SSL_new(exim_client_ctx->ctx)))
3118 {
3119 tls_error(US"SSL_new", host, NULL, errstr);
3120 return FALSE;
3121 }
3122 SSL_set_session_id_context(exim_client_ctx->ssl, sid_ctx, Ustrlen(sid_ctx));
3123
3124 SSL_set_fd(exim_client_ctx->ssl, cctx->sock);
3125 SSL_set_connect_state(exim_client_ctx->ssl);
3126
3127 if (ob->tls_sni)
3128 {
3129 if (!expand_check(ob->tls_sni, US"tls_sni", &tlsp->sni, errstr))
3130 return FALSE;
3131 if (!tlsp->sni)
3132 {
3133 DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
3134 }
3135 else if (!Ustrlen(tlsp->sni))
3136 tlsp->sni = NULL;
3137 else
3138 {
3139 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
3140 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tlsp->sni);
3141 SSL_set_tlsext_host_name(exim_client_ctx->ssl, tlsp->sni);
3142 #else
3143 log_write(0, LOG_MAIN, "SNI unusable with this OpenSSL library version; ignoring \"%s\"\n",
3144 tlsp->sni);
3145 #endif
3146 }
3147 }
3148
3149 #ifdef SUPPORT_DANE
3150 if (conn_args->dane)
3151 if (dane_tlsa_load(exim_client_ctx->ssl, host, &conn_args->tlsa_dnsa, errstr) != OK)
3152 return FALSE;
3153 #endif
3154
3155 #ifndef DISABLE_OCSP
3156 /* Request certificate status at connection-time. If the server
3157 does OCSP stapling we will get the callback (set in tls_init()) */
3158 # ifdef SUPPORT_DANE
3159 if (request_ocsp)
3160 {
3161 const uschar * s;
3162 if ( ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
3163 || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
3164 )
3165 { /* Re-eval now $tls_out_tlsa_usage is populated. If
3166 this means we avoid the OCSP request, we wasted the setup
3167 cost in tls_init(). */
3168 require_ocsp = verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
3169 request_ocsp = require_ocsp
3170 || verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
3171 }
3172 }
3173 # endif
3174
3175 if (request_ocsp)
3176 {
3177 SSL_set_tlsext_status_type(exim_client_ctx->ssl, TLSEXT_STATUSTYPE_ocsp);
3178 client_static_cbinfo->u_ocsp.client.verify_required = require_ocsp;
3179 tlsp->ocsp = OCSP_NOT_RESP;
3180 }
3181 #endif
3182
3183 #ifdef EXPERIMENTAL_TLS_RESUME
3184 if (!tls_client_ssl_resume_prehandshake(exim_client_ctx->ssl, tlsp, host,
3185 errstr))
3186 return FALSE;
3187 #endif
3188
3189 #ifndef DISABLE_EVENT
3190 client_static_cbinfo->event_action = tb ? tb->event_action : NULL;
3191 #endif
3192
3193 /* There doesn't seem to be a built-in timeout on connection. */
3194
3195 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
3196 sigalrm_seen = FALSE;
3197 ALARM(ob->command_timeout);
3198 rc = SSL_connect(exim_client_ctx->ssl);
3199 ALARM_CLR(0);
3200
3201 #ifdef SUPPORT_DANE
3202 if (conn_args->dane)
3203 DANESSL_cleanup(exim_client_ctx->ssl);
3204 #endif
3205
3206 if (rc <= 0)
3207 {
3208 tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL, errstr);
3209 return FALSE;
3210 }
3211
3212 DEBUG(D_tls)
3213 {
3214 debug_printf("SSL_connect succeeded\n");
3215 #ifdef EXIM_HAVE_OPENSSL_KEYLOG
3216 {
3217 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
3218 SSL_SESSION_print_keylog(bp, SSL_get_session(exim_client_ctx->ssl));
3219 BIO_free(bp);
3220 }
3221 #endif
3222 }
3223
3224 #ifdef EXPERIMENTAL_TLS_RESUME
3225 tls_client_resume_posthandshake(exim_client_ctx, tlsp);
3226 #endif
3227
3228 peer_cert(exim_client_ctx->ssl, tlsp, peerdn, sizeof(peerdn));
3229
3230 tlsp->cipher = construct_cipher_name(exim_client_ctx->ssl, &tlsp->bits);
3231 tlsp->cipher_stdname = cipher_stdname_ssl(exim_client_ctx->ssl);
3232
3233 /* Record the certificate we presented */
3234 {
3235 X509 * crt = SSL_get_certificate(exim_client_ctx->ssl);
3236 tlsp->ourcert = crt ? X509_dup(crt) : NULL;
3237 }
3238
3239 tlsp->active.sock = cctx->sock;
3240 tlsp->active.tls_ctx = exim_client_ctx;
3241 cctx->tls_ctx = exim_client_ctx;
3242 return TRUE;
3243 }
3244
3245
3246
3247
3248
3249 static BOOL
3250 tls_refill(unsigned lim)
3251 {
3252 int error;
3253 int inbytes;
3254
3255 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", server_ssl,
3256 ssl_xfer_buffer, ssl_xfer_buffer_size);
3257
3258 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3259 inbytes = SSL_read(server_ssl, CS ssl_xfer_buffer,
3260 MIN(ssl_xfer_buffer_size, lim));
3261 error = SSL_get_error(server_ssl, inbytes);
3262 if (smtp_receive_timeout > 0) ALARM_CLR(0);
3263
3264 if (had_command_timeout) /* set by signal handler */
3265 smtp_command_timeout_exit(); /* does not return */
3266 if (had_command_sigterm)
3267 smtp_command_sigterm_exit();
3268 if (had_data_timeout)
3269 smtp_data_timeout_exit();
3270 if (had_data_sigint)
3271 smtp_data_sigint_exit();
3272
3273 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
3274 closed down, not that the socket itself has been closed down. Revert to
3275 non-SSL handling. */
3276
3277 switch(error)
3278 {
3279 case SSL_ERROR_NONE:
3280 break;
3281
3282 case SSL_ERROR_ZERO_RETURN:
3283 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
3284
3285 if (SSL_get_shutdown(server_ssl) == SSL_RECEIVED_SHUTDOWN)
3286 SSL_shutdown(server_ssl);
3287
3288 tls_close(NULL, TLS_NO_SHUTDOWN);
3289 return FALSE;
3290
3291 /* Handle genuine errors */
3292 case SSL_ERROR_SSL:
3293 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
3294 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
3295 ssl_xfer_error = TRUE;
3296 return FALSE;
3297
3298 default:
3299 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
3300 DEBUG(D_tls) if (error == SSL_ERROR_SYSCALL)
3301 debug_printf(" - syscall %s\n", strerror(errno));
3302 ssl_xfer_error = TRUE;
3303 return FALSE;
3304 }
3305
3306 #ifndef DISABLE_DKIM
3307 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
3308 #endif
3309 ssl_xfer_buffer_hwm = inbytes;
3310 ssl_xfer_buffer_lwm = 0;
3311 return TRUE;
3312 }
3313
3314
3315 /*************************************************
3316 * TLS version of getc *
3317 *************************************************/
3318
3319 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
3320 it refills the buffer via the SSL reading function.
3321
3322 Arguments: lim Maximum amount to read/buffer
3323 Returns: the next character or EOF
3324
3325 Only used by the server-side TLS.
3326 */
3327
3328 int
3329 tls_getc(unsigned lim)
3330 {
3331 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
3332 if (!tls_refill(lim))
3333 return ssl_xfer_error ? EOF : smtp_getc(lim);
3334
3335 /* Something in the buffer; return next uschar */
3336
3337 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
3338 }
3339
3340 uschar *
3341 tls_getbuf(unsigned * len)
3342 {
3343 unsigned size;
3344 uschar * buf;
3345
3346 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
3347 if (!tls_refill(*len))
3348 {
3349 if (!ssl_xfer_error) return smtp_getbuf(len);
3350 *len = 0;
3351 return NULL;
3352 }
3353
3354 if ((size = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm) > *len)
3355 size = *len;
3356 buf = &ssl_xfer_buffer[ssl_xfer_buffer_lwm];
3357 ssl_xfer_buffer_lwm += size;
3358 *len = size;
3359 return buf;
3360 }
3361
3362
3363 void
3364 tls_get_cache()
3365 {
3366 #ifndef DISABLE_DKIM
3367 int n = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm;
3368 if (n > 0)
3369 dkim_exim_verify_feed(ssl_xfer_buffer+ssl_xfer_buffer_lwm, n);
3370 #endif
3371 }
3372
3373
3374 BOOL
3375 tls_could_read(void)
3376 {
3377 return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm || SSL_pending(server_ssl) > 0;
3378 }
3379
3380
3381 /*************************************************
3382 * Read bytes from TLS channel *
3383 *************************************************/
3384
3385 /*
3386 Arguments:
3387 ct_ctx client context pointer, or NULL for the one global server context
3388 buff buffer of data
3389 len size of buffer
3390
3391 Returns: the number of bytes read
3392 -1 after a failed read, including EOF
3393
3394 Only used by the client-side TLS.
3395 */
3396
3397 int
3398 tls_read(void * ct_ctx, uschar *buff, size_t len)
3399 {
3400 SSL * ssl = ct_ctx ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl : server_ssl;
3401 int inbytes;
3402 int error;
3403
3404 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
3405 buff, (unsigned int)len);
3406
3407 inbytes = SSL_read(ssl, CS buff, len);
3408 error = SSL_get_error(ssl, inbytes);
3409
3410 if (error == SSL_ERROR_ZERO_RETURN)
3411 {
3412 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
3413 return -1;
3414 }
3415 else if (error != SSL_ERROR_NONE)
3416 return -1;
3417
3418 return inbytes;
3419 }
3420
3421
3422
3423
3424
3425 /*************************************************
3426 * Write bytes down TLS channel *
3427 *************************************************/
3428
3429 /*
3430 Arguments: