26cc986c5d32583e25978ee0c65a35a20de241af
[exim.git] / src / src / tls-openssl.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2019 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Portions Copyright (c) The OpenSSL Project 1999 */
9
10 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
11 library. It is #included into the tls.c file when that library is used. The
12 code herein is based on a patch that was originally contributed by Steve
13 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
14
15 No cryptographic code is included in Exim. All this module does is to call
16 functions from the OpenSSL library. */
17
18
19 /* Heading stuff */
20
21 #include <openssl/lhash.h>
22 #include <openssl/ssl.h>
23 #include <openssl/err.h>
24 #include <openssl/rand.h>
25 #ifndef OPENSSL_NO_ECDH
26 # include <openssl/ec.h>
27 #endif
28 #ifndef DISABLE_OCSP
29 # include <openssl/ocsp.h>
30 #endif
31 #ifdef SUPPORT_DANE
32 # include "danessl.h"
33 #endif
34
35
36 #ifndef DISABLE_OCSP
37 # define EXIM_OCSP_SKEW_SECONDS (300L)
38 # define EXIM_OCSP_MAX_AGE (-1L)
39 #endif
40
41 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
42 # define EXIM_HAVE_OPENSSL_TLSEXT
43 #endif
44 #if OPENSSL_VERSION_NUMBER >= 0x00908000L
45 # define EXIM_HAVE_RSA_GENKEY_EX
46 #endif
47 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
48 # define EXIM_HAVE_OCSP_RESP_COUNT
49 # define OPENSSL_AUTO_SHA256
50 #else
51 # define EXIM_HAVE_EPHEM_RSA_KEX
52 # define EXIM_HAVE_RAND_PSEUDO
53 #endif
54 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
55 # define EXIM_HAVE_SHA256
56 #endif
57
58 /* X509_check_host provides sane certificate hostname checking, but was added
59 to OpenSSL late, after other projects forked off the code-base. So in
60 addition to guarding against the base version number, beware that LibreSSL
61 does not (at this time) support this function.
62
63 If LibreSSL gains a different API, perhaps via libtls, then we'll probably
64 opt to disentangle and ask a LibreSSL user to provide glue for a third
65 crypto provider for libtls instead of continuing to tie the OpenSSL glue
66 into even twistier knots. If LibreSSL gains the same API, we can just
67 change this guard and punt the issue for a while longer. */
68
69 #ifndef LIBRESSL_VERSION_NUMBER
70 # if OPENSSL_VERSION_NUMBER >= 0x010100000L
71 # define EXIM_HAVE_OPENSSL_CHECKHOST
72 # define EXIM_HAVE_OPENSSL_DH_BITS
73 # define EXIM_HAVE_OPENSSL_TLS_METHOD
74 # define EXIM_HAVE_OPENSSL_KEYLOG
75 # define EXIM_HAVE_OPENSSL_CIPHER_GET_ID
76 # define EXIM_HAVE_SESSION_TICKET
77 # define EXIM_HAVE_OPESSL_TRACE
78 # define EXIM_HAVE_OPESSL_GET0_SERIAL
79 # ifndef DISABLE_OCSP
80 # define EXIM_HAVE_OCSP
81 # endif
82 # else
83 # define EXIM_NEED_OPENSSL_INIT
84 # endif
85 # if OPENSSL_VERSION_NUMBER >= 0x010000000L \
86 && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
87 # define EXIM_HAVE_OPENSSL_CHECKHOST
88 # endif
89 #endif
90
91 #if !defined(LIBRESSL_VERSION_NUMBER) \
92 || LIBRESSL_VERSION_NUMBER >= 0x20010000L
93 # if !defined(OPENSSL_NO_ECDH)
94 # if OPENSSL_VERSION_NUMBER >= 0x0090800fL
95 # define EXIM_HAVE_ECDH
96 # endif
97 # if OPENSSL_VERSION_NUMBER >= 0x10002000L
98 # define EXIM_HAVE_OPENSSL_EC_NIST2NID
99 # endif
100 # endif
101 #endif
102
103 #ifndef LIBRESSL_VERSION_NUMBER
104 # if OPENSSL_VERSION_NUMBER >= 0x010101000L
105 # define OPENSSL_HAVE_KEYLOG_CB
106 # define OPENSSL_HAVE_NUM_TICKETS
107 # define EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
108 # else
109 # define OPENSSL_BAD_SRVR_OURCERT
110 # endif
111 #endif
112
113 #if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
114 # warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
115 # define DISABLE_OCSP
116 #endif
117
118 #ifdef EXPERIMENTAL_TLS_RESUME
119 # if OPENSSL_VERSION_NUMBER < 0x0101010L
120 # error OpenSSL version too old for session-resumption
121 # endif
122 #endif
123
124 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
125 # include <openssl/x509v3.h>
126 #endif
127
128 #ifndef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
129 # ifndef EXIM_HAVE_OPENSSL_CIPHER_GET_ID
130 # define SSL_CIPHER_get_id(c) (c->id)
131 # endif
132 # ifndef MACRO_PREDEF
133 # include "tls-cipher-stdname.c"
134 # endif
135 #endif
136
137 /*************************************************
138 * OpenSSL option parse *
139 *************************************************/
140
141 typedef struct exim_openssl_option {
142 uschar *name;
143 long value;
144 } exim_openssl_option;
145 /* We could use a macro to expand, but we need the ifdef and not all the
146 options document which version they were introduced in. Policylet: include
147 all options unless explicitly for DTLS, let the administrator choose which
148 to apply.
149
150 This list is current as of:
151 ==> 1.1.1c <==
152
153 XXX could we autobuild this list, as with predefined-macros?
154 Seems just parsing ssl.h for SSL_OP_.* would be enough (except to exclude DTLS).
155 Also allow a numeric literal?
156 */
157 static exim_openssl_option exim_openssl_options[] = {
158 /* KEEP SORTED ALPHABETICALLY! */
159 #ifdef SSL_OP_ALL
160 { US"all", (long) SSL_OP_ALL },
161 #endif
162 #ifdef SSL_OP_ALLOW_NO_DHE_KEX
163 { US"allow_no_dhe_kex", SSL_OP_ALLOW_NO_DHE_KEX },
164 #endif
165 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
166 { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
167 #endif
168 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
169 { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
170 #endif
171 #ifdef SSL_OP_CRYPTOPRO_TLSEXT_BUG
172 { US"cryptopro_tlsext_bug", SSL_OP_CRYPTOPRO_TLSEXT_BUG },
173 #endif
174 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
175 { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
176 #endif
177 #ifdef SSL_OP_ENABLE_MIDDLEBOX_COMPAT
178 { US"enable_middlebox_compat", SSL_OP_ENABLE_MIDDLEBOX_COMPAT },
179 #endif
180 #ifdef SSL_OP_EPHEMERAL_RSA
181 { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
182 #endif
183 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
184 { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
185 #endif
186 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
187 { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
188 #endif
189 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
190 { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
191 #endif
192 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
193 { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
194 #endif
195 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
196 { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
197 #endif
198 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
199 { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
200 #endif
201 #ifdef SSL_OP_NO_ANTI_REPLAY
202 { US"no_anti_replay", SSL_OP_NO_ANTI_REPLAY },
203 #endif
204 #ifdef SSL_OP_NO_COMPRESSION
205 { US"no_compression", SSL_OP_NO_COMPRESSION },
206 #endif
207 #ifdef SSL_OP_NO_ENCRYPT_THEN_MAC
208 { US"no_encrypt_then_mac", SSL_OP_NO_ENCRYPT_THEN_MAC },
209 #endif
210 #ifdef SSL_OP_NO_RENEGOTIATION
211 { US"no_renegotiation", SSL_OP_NO_RENEGOTIATION },
212 #endif
213 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
214 { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
215 #endif
216 #ifdef SSL_OP_NO_SSLv2
217 { US"no_sslv2", SSL_OP_NO_SSLv2 },
218 #endif
219 #ifdef SSL_OP_NO_SSLv3
220 { US"no_sslv3", SSL_OP_NO_SSLv3 },
221 #endif
222 #ifdef SSL_OP_NO_TICKET
223 { US"no_ticket", SSL_OP_NO_TICKET },
224 #endif
225 #ifdef SSL_OP_NO_TLSv1
226 { US"no_tlsv1", SSL_OP_NO_TLSv1 },
227 #endif
228 #ifdef SSL_OP_NO_TLSv1_1
229 #if SSL_OP_NO_TLSv1_1 == 0x00000400L
230 /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
231 #warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
232 #else
233 { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
234 #endif
235 #endif
236 #ifdef SSL_OP_NO_TLSv1_2
237 { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
238 #endif
239 #ifdef SSL_OP_NO_TLSv1_3
240 { US"no_tlsv1_3", SSL_OP_NO_TLSv1_3 },
241 #endif
242 #ifdef SSL_OP_PRIORITIZE_CHACHA
243 { US"prioritize_chacha", SSL_OP_PRIORITIZE_CHACHA },
244 #endif
245 #ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
246 { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
247 #endif
248 #ifdef SSL_OP_SINGLE_DH_USE
249 { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
250 #endif
251 #ifdef SSL_OP_SINGLE_ECDH_USE
252 { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
253 #endif
254 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
255 { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
256 #endif
257 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
258 { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
259 #endif
260 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
261 { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
262 #endif
263 #ifdef SSL_OP_TLS_D5_BUG
264 { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
265 #endif
266 #ifdef SSL_OP_TLS_ROLLBACK_BUG
267 { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
268 #endif
269 #ifdef SSL_OP_TLSEXT_PADDING
270 { US"tlsext_padding", SSL_OP_TLSEXT_PADDING },
271 #endif
272 };
273
274 #ifndef MACRO_PREDEF
275 static int exim_openssl_options_size = nelem(exim_openssl_options);
276 #endif
277
278 #ifdef MACRO_PREDEF
279 void
280 options_tls(void)
281 {
282 uschar buf[64];
283
284 for (struct exim_openssl_option * o = exim_openssl_options;
285 o < exim_openssl_options + nelem(exim_openssl_options); o++)
286 {
287 /* Trailing X is workaround for problem with _OPT_OPENSSL_NO_TLSV1
288 being a ".ifdef _OPT_OPENSSL_NO_TLSV1_3" match */
289
290 spf(buf, sizeof(buf), US"_OPT_OPENSSL_%T_X", o->name);
291 builtin_macro_create(buf);
292 }
293
294 # ifdef EXPERIMENTAL_TLS_RESUME
295 builtin_macro_create_var(US"_RESUME_DECODE", RESUME_DECODE_STRING );
296 # endif
297 # ifdef SSL_OP_NO_TLSv1_3
298 builtin_macro_create(US"_HAVE_TLS1_3");
299 # endif
300 # ifdef OPENSSL_BAD_SRVR_OURCERT
301 builtin_macro_create(US"_TLS_BAD_MULTICERT_IN_OURCERT");
302 # endif
303 # ifdef EXIM_HAVE_OCSP
304 builtin_macro_create(US"_HAVE_TLS_OCSP");
305 builtin_macro_create(US"_HAVE_TLS_OCSP_LIST");
306 # endif
307 }
308 #else
309
310 /******************************************************************************/
311
312 /* Structure for collecting random data for seeding. */
313
314 typedef struct randstuff {
315 struct timeval tv;
316 pid_t p;
317 } randstuff;
318
319 /* Local static variables */
320
321 static BOOL client_verify_callback_called = FALSE;
322 static BOOL server_verify_callback_called = FALSE;
323 static const uschar *sid_ctx = US"exim";
324
325 /* We have three different contexts to care about.
326
327 Simple case: client, `client_ctx`
328 As a client, we can be doing a callout or cut-through delivery while receiving
329 a message. So we have a client context, which should have options initialised
330 from the SMTP Transport. We may also concurrently want to make TLS connections
331 to utility daemons, so client-contexts are allocated and passed around in call
332 args rather than using a gobal.
333
334 Server:
335 There are two cases: with and without ServerNameIndication from the client.
336 Given TLS SNI, we can be using different keys, certs and various other
337 configuration settings, because they're re-expanded with $tls_sni set. This
338 allows vhosting with TLS. This SNI is sent in the handshake.
339 A client might not send SNI, so we need a fallback, and an initial setup too.
340 So as a server, we start out using `server_ctx`.
341 If SNI is sent by the client, then we as server, mid-negotiation, try to clone
342 `server_sni` from `server_ctx` and then initialise settings by re-expanding
343 configuration.
344 */
345
346 typedef struct {
347 SSL_CTX * ctx;
348 SSL * ssl;
349 gstring * corked;
350 } exim_openssl_client_tls_ctx;
351
352 static SSL_CTX *server_ctx = NULL;
353 static SSL *server_ssl = NULL;
354
355 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
356 static SSL_CTX *server_sni = NULL;
357 #endif
358
359 static char ssl_errstring[256];
360
361 static int ssl_session_timeout = 7200; /* Two hours */
362 static BOOL client_verify_optional = FALSE;
363 static BOOL server_verify_optional = FALSE;
364
365 static BOOL reexpand_tls_files_for_sni = FALSE;
366
367
368 typedef struct ocsp_resp {
369 struct ocsp_resp * next;
370 OCSP_RESPONSE * resp;
371 } ocsp_resplist;
372
373 typedef struct tls_ext_ctx_cb {
374 tls_support * tlsp;
375 uschar *certificate;
376 uschar *privatekey;
377 BOOL is_server;
378 #ifndef DISABLE_OCSP
379 STACK_OF(X509) *verify_stack; /* chain for verifying the proof */
380 union {
381 struct {
382 uschar *file;
383 const uschar *file_expanded;
384 ocsp_resplist *olist;
385 } server;
386 struct {
387 X509_STORE *verify_store; /* non-null if status requested */
388 BOOL verify_required;
389 } client;
390 } u_ocsp;
391 #endif
392 uschar *dhparam;
393 /* these are cached from first expand */
394 uschar *server_cipher_list;
395 /* only passed down to tls_error: */
396 host_item *host;
397 const uschar * verify_cert_hostnames;
398 #ifndef DISABLE_EVENT
399 uschar * event_action;
400 #endif
401 } tls_ext_ctx_cb;
402
403 /* should figure out a cleanup of API to handle state preserved per
404 implementation, for various reasons, which can be void * in the APIs.
405 For now, we hack around it. */
406 tls_ext_ctx_cb *client_static_cbinfo = NULL; /*XXX should not use static; multiple concurrent clients! */
407 tls_ext_ctx_cb *server_static_cbinfo = NULL;
408
409 static int
410 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
411 int (*cert_vfy_cb)(int, X509_STORE_CTX *), uschar ** errstr );
412
413 /* Callbacks */
414 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
415 static int tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg);
416 #endif
417 #ifndef DISABLE_OCSP
418 static int tls_server_stapling_cb(SSL *s, void *arg);
419 #endif
420
421
422
423 /* Daemon-called, before every connection, key create/rotate */
424 #ifdef EXPERIMENTAL_TLS_RESUME
425 static void tk_init(void);
426 static int tls_exdata_idx = -1;
427 #endif
428
429 void
430 tls_daemon_init(void)
431 {
432 #ifdef EXPERIMENTAL_TLS_RESUME
433 tk_init();
434 #endif
435 return;
436 }
437
438
439 /*************************************************
440 * Handle TLS error *
441 *************************************************/
442
443 /* Called from lots of places when errors occur before actually starting to do
444 the TLS handshake, that is, while the session is still in clear. Always returns
445 DEFER for a server and FAIL for a client so that most calls can use "return
446 tls_error(...)" to do this processing and then give an appropriate return. A
447 single function is used for both server and client, because it is called from
448 some shared functions.
449
450 Argument:
451 prefix text to include in the logged error
452 host NULL if setting up a server;
453 the connected host if setting up a client
454 msg error message or NULL if we should ask OpenSSL
455 errstr pointer to output error message
456
457 Returns: OK/DEFER/FAIL
458 */
459
460 static int
461 tls_error(uschar * prefix, const host_item * host, uschar * msg, uschar ** errstr)
462 {
463 if (!msg)
464 {
465 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
466 msg = US ssl_errstring;
467 }
468
469 msg = string_sprintf("(%s): %s", prefix, msg);
470 DEBUG(D_tls) debug_printf("TLS error '%s'\n", msg);
471 if (errstr) *errstr = msg;
472 return host ? FAIL : DEFER;
473 }
474
475
476
477 /*************************************************
478 * Callback to generate RSA key *
479 *************************************************/
480
481 /*
482 Arguments:
483 s SSL connection (not used)
484 export not used
485 keylength keylength
486
487 Returns: pointer to generated key
488 */
489
490 static RSA *
491 rsa_callback(SSL *s, int export, int keylength)
492 {
493 RSA *rsa_key;
494 #ifdef EXIM_HAVE_RSA_GENKEY_EX
495 BIGNUM *bn = BN_new();
496 #endif
497
498 export = export; /* Shut picky compilers up */
499 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
500
501 #ifdef EXIM_HAVE_RSA_GENKEY_EX
502 if ( !BN_set_word(bn, (unsigned long)RSA_F4)
503 || !(rsa_key = RSA_new())
504 || !RSA_generate_key_ex(rsa_key, keylength, bn, NULL)
505 )
506 #else
507 if (!(rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL)))
508 #endif
509
510 {
511 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
512 log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
513 ssl_errstring);
514 return NULL;
515 }
516 return rsa_key;
517 }
518
519
520
521 /* Extreme debug
522 #ifndef DISABLE_OCSP
523 void
524 x509_store_dump_cert_s_names(X509_STORE * store)
525 {
526 STACK_OF(X509_OBJECT) * roots= store->objs;
527 static uschar name[256];
528
529 for (int i= 0; i < sk_X509_OBJECT_num(roots); i++)
530 {
531 X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
532 if(tmp_obj->type == X509_LU_X509)
533 {
534 X509_NAME * sn = X509_get_subject_name(tmp_obj->data.x509);
535 if (X509_NAME_oneline(sn, CS name, sizeof(name)))
536 {
537 name[sizeof(name)-1] = '\0';
538 debug_printf(" %s\n", name);
539 }
540 }
541 }
542 }
543 #endif
544 */
545
546
547 #ifndef DISABLE_EVENT
548 static int
549 verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
550 BOOL *calledp, const BOOL *optionalp, const uschar * what)
551 {
552 uschar * ev;
553 uschar * yield;
554 X509 * old_cert;
555
556 ev = tlsp == &tls_out ? client_static_cbinfo->event_action : event_action;
557 if (ev)
558 {
559 DEBUG(D_tls) debug_printf("verify_event: %s %d\n", what, depth);
560 old_cert = tlsp->peercert;
561 tlsp->peercert = X509_dup(cert);
562 /* NB we do not bother setting peerdn */
563 if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth))))
564 {
565 log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
566 "depth=%d cert=%s: %s",
567 tlsp == &tls_out ? deliver_host_address : sender_host_address,
568 what, depth, dn, yield);
569 *calledp = TRUE;
570 if (!*optionalp)
571 {
572 if (old_cert) tlsp->peercert = old_cert; /* restore 1st failing cert */
573 return 1; /* reject (leaving peercert set) */
574 }
575 DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
576 "(host in tls_try_verify_hosts)\n");
577 tlsp->verify_override = TRUE;
578 }
579 X509_free(tlsp->peercert);
580 tlsp->peercert = old_cert;
581 }
582 return 0;
583 }
584 #endif
585
586 /*************************************************
587 * Callback for verification *
588 *************************************************/
589
590 /* The SSL library does certificate verification if set up to do so. This
591 callback has the current yes/no state is in "state". If verification succeeded,
592 we set the certificate-verified flag. If verification failed, what happens
593 depends on whether the client is required to present a verifiable certificate
594 or not.
595
596 If verification is optional, we change the state to yes, but still log the
597 verification error. For some reason (it really would help to have proper
598 documentation of OpenSSL), this callback function then gets called again, this
599 time with state = 1. We must take care not to set the private verified flag on
600 the second time through.
601
602 Note: this function is not called if the client fails to present a certificate
603 when asked. We get here only if a certificate has been received. Handling of
604 optional verification for this case is done when requesting SSL to verify, by
605 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
606
607 May be called multiple times for different issues with a certificate, even
608 for a given "depth" in the certificate chain.
609
610 Arguments:
611 preverify_ok current yes/no state as 1/0
612 x509ctx certificate information.
613 tlsp per-direction (client vs. server) support data
614 calledp has-been-called flag
615 optionalp verification-is-optional flag
616
617 Returns: 0 if verification should fail, otherwise 1
618 */
619
620 static int
621 verify_callback(int preverify_ok, X509_STORE_CTX * x509ctx,
622 tls_support * tlsp, BOOL * calledp, BOOL * optionalp)
623 {
624 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
625 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
626 uschar dn[256];
627
628 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
629 {
630 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
631 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
632 tlsp == &tls_out ? deliver_host_address : sender_host_address);
633 return 0;
634 }
635 dn[sizeof(dn)-1] = '\0';
636
637 tlsp->verify_override = FALSE;
638 if (preverify_ok == 0)
639 {
640 uschar * extra = verify_mode ? string_sprintf(" (during %c-verify for [%s])",
641 *verify_mode, sender_host_address)
642 : US"";
643 log_write(0, LOG_MAIN, "[%s] SSL verify error%s: depth=%d error=%s cert=%s",
644 tlsp == &tls_out ? deliver_host_address : sender_host_address,
645 extra, depth,
646 X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)), dn);
647 *calledp = TRUE;
648 if (!*optionalp)
649 {
650 if (!tlsp->peercert)
651 tlsp->peercert = X509_dup(cert); /* record failing cert */
652 return 0; /* reject */
653 }
654 DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
655 "tls_try_verify_hosts)\n");
656 tlsp->verify_override = TRUE;
657 }
658
659 else if (depth != 0)
660 {
661 DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);
662 #ifndef DISABLE_OCSP
663 if (tlsp == &tls_out && client_static_cbinfo->u_ocsp.client.verify_store)
664 { /* client, wanting stapling */
665 /* Add the server cert's signing chain as the one
666 for the verification of the OCSP stapled information. */
667
668 if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
669 cert))
670 ERR_clear_error();
671 sk_X509_push(client_static_cbinfo->verify_stack, cert);
672 }
673 #endif
674 #ifndef DISABLE_EVENT
675 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
676 return 0; /* reject, with peercert set */
677 #endif
678 }
679 else
680 {
681 const uschar * verify_cert_hostnames;
682
683 if ( tlsp == &tls_out
684 && ((verify_cert_hostnames = client_static_cbinfo->verify_cert_hostnames)))
685 /* client, wanting hostname check */
686 {
687
688 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
689 # ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
690 # define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
691 # endif
692 # ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
693 # define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
694 # endif
695 int sep = 0;
696 const uschar * list = verify_cert_hostnames;
697 uschar * name;
698 int rc;
699 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
700 if ((rc = X509_check_host(cert, CCS name, 0,
701 X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
702 | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS,
703 NULL)))
704 {
705 if (rc < 0)
706 {
707 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
708 tlsp == &tls_out ? deliver_host_address : sender_host_address);
709 name = NULL;
710 }
711 break;
712 }
713 if (!name)
714 #else
715 if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
716 #endif
717 {
718 uschar * extra = verify_mode
719 ? string_sprintf(" (during %c-verify for [%s])",
720 *verify_mode, sender_host_address)
721 : US"";
722 log_write(0, LOG_MAIN,
723 "[%s] SSL verify error%s: certificate name mismatch: DN=\"%s\" H=\"%s\"",
724 tlsp == &tls_out ? deliver_host_address : sender_host_address,
725 extra, dn, verify_cert_hostnames);
726 *calledp = TRUE;
727 if (!*optionalp)
728 {
729 if (!tlsp->peercert)
730 tlsp->peercert = X509_dup(cert); /* record failing cert */
731 return 0; /* reject */
732 }
733 DEBUG(D_tls) debug_printf("SSL verify name failure overridden (host in "
734 "tls_try_verify_hosts)\n");
735 tlsp->verify_override = TRUE;
736 }
737 }
738
739 #ifndef DISABLE_EVENT
740 if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
741 return 0; /* reject, with peercert set */
742 #endif
743
744 DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
745 *calledp ? "" : " authenticated", dn);
746 *calledp = TRUE;
747 }
748
749 return 1; /* accept, at least for this level */
750 }
751
752 static int
753 verify_callback_client(int preverify_ok, X509_STORE_CTX *x509ctx)
754 {
755 return verify_callback(preverify_ok, x509ctx, &tls_out,
756 &client_verify_callback_called, &client_verify_optional);
757 }
758
759 static int
760 verify_callback_server(int preverify_ok, X509_STORE_CTX *x509ctx)
761 {
762 return verify_callback(preverify_ok, x509ctx, &tls_in,
763 &server_verify_callback_called, &server_verify_optional);
764 }
765
766
767 #ifdef SUPPORT_DANE
768
769 /* This gets called *by* the dane library verify callback, which interposes
770 itself.
771 */
772 static int
773 verify_callback_client_dane(int preverify_ok, X509_STORE_CTX * x509ctx)
774 {
775 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
776 uschar dn[256];
777 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
778 #ifndef DISABLE_EVENT
779 BOOL dummy_called, optional = FALSE;
780 #endif
781
782 if (!X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn)))
783 {
784 DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n");
785 log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
786 deliver_host_address);
787 return 0;
788 }
789 dn[sizeof(dn)-1] = '\0';
790
791 DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s depth %d %s\n",
792 preverify_ok ? "ok":"BAD", depth, dn);
793
794 #ifndef DISABLE_EVENT
795 if (verify_event(&tls_out, cert, depth, dn,
796 &dummy_called, &optional, US"DANE"))
797 return 0; /* reject, with peercert set */
798 #endif
799
800 if (preverify_ok == 1)
801 {
802 tls_out.dane_verified = TRUE;
803 #ifndef DISABLE_OCSP
804 if (client_static_cbinfo->u_ocsp.client.verify_store)
805 { /* client, wanting stapling */
806 /* Add the server cert's signing chain as the one
807 for the verification of the OCSP stapled information. */
808
809 if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
810 cert))
811 ERR_clear_error();
812 sk_X509_push(client_static_cbinfo->verify_stack, cert);
813 }
814 #endif
815 }
816 else
817 {
818 int err = X509_STORE_CTX_get_error(x509ctx);
819 DEBUG(D_tls)
820 debug_printf(" - err %d '%s'\n", err, X509_verify_cert_error_string(err));
821 if (err == X509_V_ERR_APPLICATION_VERIFICATION)
822 preverify_ok = 1;
823 }
824 return preverify_ok;
825 }
826
827 #endif /*SUPPORT_DANE*/
828
829
830 /*************************************************
831 * Information callback *
832 *************************************************/
833
834 /* The SSL library functions call this from time to time to indicate what they
835 are doing. We copy the string to the debugging output when TLS debugging has
836 been requested.
837
838 Arguments:
839 s the SSL connection
840 where
841 ret
842
843 Returns: nothing
844 */
845
846 static void
847 info_callback(SSL *s, int where, int ret)
848 {
849 DEBUG(D_tls)
850 {
851 const uschar * str;
852
853 if (where & SSL_ST_CONNECT)
854 str = US"SSL_connect";
855 else if (where & SSL_ST_ACCEPT)
856 str = US"SSL_accept";
857 else
858 str = US"SSL info (undefined)";
859
860 if (where & SSL_CB_LOOP)
861 debug_printf("%s: %s\n", str, SSL_state_string_long(s));
862 else if (where & SSL_CB_ALERT)
863 debug_printf("SSL3 alert %s:%s:%s\n",
864 str = where & SSL_CB_READ ? US"read" : US"write",
865 SSL_alert_type_string_long(ret), SSL_alert_desc_string_long(ret));
866 else if (where & SSL_CB_EXIT)
867 if (ret == 0)
868 debug_printf("%s: failed in %s\n", str, SSL_state_string_long(s));
869 else if (ret < 0)
870 debug_printf("%s: error in %s\n", str, SSL_state_string_long(s));
871 else if (where & SSL_CB_HANDSHAKE_START)
872 debug_printf("%s: hshake start: %s\n", str, SSL_state_string_long(s));
873 else if (where & SSL_CB_HANDSHAKE_DONE)
874 debug_printf("%s: hshake done: %s\n", str, SSL_state_string_long(s));
875 }
876 }
877
878 #ifdef OPENSSL_HAVE_KEYLOG_CB
879 static void
880 keylog_callback(const SSL *ssl, const char *line)
881 {
882 char * filename;
883 FILE * fp;
884 DEBUG(D_tls) debug_printf("%.200s\n", line);
885 if (!(filename = getenv("SSLKEYLOGFILE"))) return;
886 if (!(fp = fopen(filename, "a"))) return;
887 fprintf(fp, "%s\n", line);
888 fclose(fp);
889 }
890 #endif
891
892
893 #ifdef EXPERIMENTAL_TLS_RESUME
894 /* Manage the keysets used for encrypting the session tickets, on the server. */
895
896 typedef struct { /* Session ticket encryption key */
897 uschar name[16];
898
899 const EVP_CIPHER * aes_cipher;
900 uschar aes_key[32]; /* size needed depends on cipher. aes_128 implies 128/8 = 16? */
901 const EVP_MD * hmac_hash;
902 uschar hmac_key[16];
903 time_t renew;
904 time_t expire;
905 } exim_stek;
906
907 static exim_stek exim_tk; /* current key */
908 static exim_stek exim_tk_old; /* previous key */
909
910 static void
911 tk_init(void)
912 {
913 time_t t = time(NULL);
914
915 if (exim_tk.name[0])
916 {
917 if (exim_tk.renew >= t) return;
918 exim_tk_old = exim_tk;
919 }
920
921 if (f.running_in_test_harness) ssl_session_timeout = 6;
922
923 DEBUG(D_tls) debug_printf("OpenSSL: %s STEK\n", exim_tk.name[0] ? "rotating" : "creating");
924 if (RAND_bytes(exim_tk.aes_key, sizeof(exim_tk.aes_key)) <= 0) return;
925 if (RAND_bytes(exim_tk.hmac_key, sizeof(exim_tk.hmac_key)) <= 0) return;
926 if (RAND_bytes(exim_tk.name+1, sizeof(exim_tk.name)-1) <= 0) return;
927
928 exim_tk.name[0] = 'E';
929 exim_tk.aes_cipher = EVP_aes_256_cbc();
930 exim_tk.hmac_hash = EVP_sha256();
931 exim_tk.expire = t + ssl_session_timeout;
932 exim_tk.renew = t + ssl_session_timeout/2;
933 }
934
935 static exim_stek *
936 tk_current(void)
937 {
938 if (!exim_tk.name[0]) return NULL;
939 return &exim_tk;
940 }
941
942 static exim_stek *
943 tk_find(const uschar * name)
944 {
945 return memcmp(name, exim_tk.name, sizeof(exim_tk.name)) == 0 ? &exim_tk
946 : memcmp(name, exim_tk_old.name, sizeof(exim_tk_old.name)) == 0 ? &exim_tk_old
947 : NULL;
948 }
949
950 /* Callback for session tickets, on server */
951 static int
952 ticket_key_callback(SSL * ssl, uschar key_name[16],
953 uschar * iv, EVP_CIPHER_CTX * ctx, HMAC_CTX * hctx, int enc)
954 {
955 tls_support * tlsp = server_static_cbinfo->tlsp;
956 exim_stek * key;
957
958 if (enc)
959 {
960 DEBUG(D_tls) debug_printf("ticket_key_callback: create new session\n");
961 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
962
963 if (RAND_bytes(iv, EVP_MAX_IV_LENGTH) <= 0)
964 return -1; /* insufficient random */
965
966 if (!(key = tk_current())) /* current key doesn't exist or isn't valid */
967 return 0; /* key couldn't be created */
968 memcpy(key_name, key->name, 16);
969 DEBUG(D_tls) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - time(NULL));
970
971 /*XXX will want these dependent on the ssl session strength */
972 HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
973 key->hmac_hash, NULL);
974 EVP_EncryptInit_ex(ctx, key->aes_cipher, NULL, key->aes_key, iv);
975
976 DEBUG(D_tls) debug_printf("ticket created\n");
977 return 1;
978 }
979 else
980 {
981 time_t now = time(NULL);
982
983 DEBUG(D_tls) debug_printf("ticket_key_callback: retrieve session\n");
984 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
985
986 if (!(key = tk_find(key_name)) || key->expire < now)
987 {
988 DEBUG(D_tls)
989 {
990 debug_printf("ticket not usable (%s)\n", key ? "expired" : "not found");
991 if (key) debug_printf("STEK expire " TIME_T_FMT "\n", key->expire - now);
992 }
993 return 0;
994 }
995
996 HMAC_Init_ex(hctx, key->hmac_key, sizeof(key->hmac_key),
997 key->hmac_hash, NULL);
998 EVP_DecryptInit_ex(ctx, key->aes_cipher, NULL, key->aes_key, iv);
999
1000 DEBUG(D_tls) debug_printf("ticket usable, STEK expire " TIME_T_FMT "\n", key->expire - now);
1001
1002 /* The ticket lifetime and renewal are the same as the STEK lifetime and
1003 renewal, which is overenthusiastic. A factor of, say, 3x longer STEK would
1004 be better. To do that we'd have to encode ticket lifetime in the name as
1005 we don't yet see the restored session. Could check posthandshake for TLS1.3
1006 and trigger a new ticket then, but cannot do that for TLS1.2 */
1007 return key->renew < now ? 2 : 1;
1008 }
1009 }
1010 #endif
1011
1012
1013
1014 /*************************************************
1015 * Initialize for DH *
1016 *************************************************/
1017
1018 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
1019
1020 Arguments:
1021 sctx The current SSL CTX (inbound or outbound)
1022 dhparam DH parameter file or fixed parameter identity string
1023 host connected host, if client; NULL if server
1024 errstr error string pointer
1025
1026 Returns: TRUE if OK (nothing to set up, or setup worked)
1027 */
1028
1029 static BOOL
1030 init_dh(SSL_CTX *sctx, uschar *dhparam, const host_item *host, uschar ** errstr)
1031 {
1032 BIO *bio;
1033 DH *dh;
1034 uschar *dhexpanded;
1035 const char *pem;
1036 int dh_bitsize;
1037
1038 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded, errstr))
1039 return FALSE;
1040
1041 if (!dhexpanded || !*dhexpanded)
1042 bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
1043 else if (dhexpanded[0] == '/')
1044 {
1045 if (!(bio = BIO_new_file(CS dhexpanded, "r")))
1046 {
1047 tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
1048 host, US strerror(errno), errstr);
1049 return FALSE;
1050 }
1051 }
1052 else
1053 {
1054 if (Ustrcmp(dhexpanded, "none") == 0)
1055 {
1056 DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
1057 return TRUE;
1058 }
1059
1060 if (!(pem = std_dh_prime_named(dhexpanded)))
1061 {
1062 tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
1063 host, US strerror(errno), errstr);
1064 return FALSE;
1065 }
1066 bio = BIO_new_mem_buf(CS pem, -1);
1067 }
1068
1069 if (!(dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)))
1070 {
1071 BIO_free(bio);
1072 tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
1073 host, NULL, errstr);
1074 return FALSE;
1075 }
1076
1077 /* note: our default limit of 2236 is not a multiple of 8; the limit comes from
1078 * an NSS limit, and the GnuTLS APIs handle bit-sizes fine, so we went with
1079 * 2236. But older OpenSSL can only report in bytes (octets), not bits.
1080 * If someone wants to dance at the edge, then they can raise the limit or use
1081 * current libraries. */
1082 #ifdef EXIM_HAVE_OPENSSL_DH_BITS
1083 /* Added in commit 26c79d5641d; `git describe --contains` says OpenSSL_1_1_0-pre1~1022
1084 * This predates OpenSSL_1_1_0 (before a, b, ...) so is in all 1.1.0 */
1085 dh_bitsize = DH_bits(dh);
1086 #else
1087 dh_bitsize = 8 * DH_size(dh);
1088 #endif
1089
1090 /* Even if it is larger, we silently return success rather than cause things
1091 * to fail out, so that a too-large DH will not knock out all TLS; it's a
1092 * debatable choice. */
1093 if (dh_bitsize > tls_dh_max_bits)
1094 {
1095 DEBUG(D_tls)
1096 debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d\n",
1097 dh_bitsize, tls_dh_max_bits);
1098 }
1099 else
1100 {
1101 SSL_CTX_set_tmp_dh(sctx, dh);
1102 DEBUG(D_tls)
1103 debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
1104 dhexpanded ? dhexpanded : US"default", dh_bitsize);
1105 }
1106
1107 DH_free(dh);
1108 BIO_free(bio);
1109
1110 return TRUE;
1111 }
1112
1113
1114
1115
1116 /*************************************************
1117 * Initialize for ECDH *
1118 *************************************************/
1119
1120 /* Load parameters for ECDH encryption.
1121
1122 For now, we stick to NIST P-256 because: it's simple and easy to configure;
1123 it avoids any patent issues that might bite redistributors; despite events in
1124 the news and concerns over curve choices, we're not cryptographers, we're not
1125 pretending to be, and this is "good enough" to be better than no support,
1126 protecting against most adversaries. Given another year or two, there might
1127 be sufficient clarity about a "right" way forward to let us make an informed
1128 decision, instead of a knee-jerk reaction.
1129
1130 Longer-term, we should look at supporting both various named curves and
1131 external files generated with "openssl ecparam", much as we do for init_dh().
1132 We should also support "none" as a value, to explicitly avoid initialisation.
1133
1134 Patches welcome.
1135
1136 Arguments:
1137 sctx The current SSL CTX (inbound or outbound)
1138 host connected host, if client; NULL if server
1139 errstr error string pointer
1140
1141 Returns: TRUE if OK (nothing to set up, or setup worked)
1142 */
1143
1144 static BOOL
1145 init_ecdh(SSL_CTX * sctx, host_item * host, uschar ** errstr)
1146 {
1147 #ifdef OPENSSL_NO_ECDH
1148 return TRUE;
1149 #else
1150
1151 EC_KEY * ecdh;
1152 uschar * exp_curve;
1153 int nid;
1154 BOOL rv;
1155
1156 if (host) /* No ECDH setup for clients, only for servers */
1157 return TRUE;
1158
1159 # ifndef EXIM_HAVE_ECDH
1160 DEBUG(D_tls)
1161 debug_printf("No OpenSSL API to define ECDH parameters, skipping\n");
1162 return TRUE;
1163 # else
1164
1165 if (!expand_check(tls_eccurve, US"tls_eccurve", &exp_curve, errstr))
1166 return FALSE;
1167 if (!exp_curve || !*exp_curve)
1168 return TRUE;
1169
1170 /* "auto" needs to be handled carefully.
1171 * OpenSSL < 1.0.2: we do not select anything, but fallback to prime256v1
1172 * OpenSSL < 1.1.0: we have to call SSL_CTX_set_ecdh_auto
1173 * (openssl/ssl.h defines SSL_CTRL_SET_ECDH_AUTO)
1174 * OpenSSL >= 1.1.0: we do not set anything, the libray does autoselection
1175 * https://github.com/openssl/openssl/commit/fe6ef2472db933f01b59cad82aa925736935984b
1176 */
1177 if (Ustrcmp(exp_curve, "auto") == 0)
1178 {
1179 #if OPENSSL_VERSION_NUMBER < 0x10002000L
1180 DEBUG(D_tls) debug_printf(
1181 "ECDH OpenSSL < 1.0.2: temp key parameter settings: overriding \"auto\" with \"prime256v1\"\n");
1182 exp_curve = US"prime256v1";
1183 #else
1184 # if defined SSL_CTRL_SET_ECDH_AUTO
1185 DEBUG(D_tls) debug_printf(
1186 "ECDH OpenSSL 1.0.2+ temp key parameter settings: autoselection\n");
1187 SSL_CTX_set_ecdh_auto(sctx, 1);
1188 return TRUE;
1189 # else
1190 DEBUG(D_tls) debug_printf(
1191 "ECDH OpenSSL 1.1.0+ temp key parameter settings: default selection\n");
1192 return TRUE;
1193 # endif
1194 #endif
1195 }
1196
1197 DEBUG(D_tls) debug_printf("ECDH: curve '%s'\n", exp_curve);
1198 if ( (nid = OBJ_sn2nid (CCS exp_curve)) == NID_undef
1199 # ifdef EXIM_HAVE_OPENSSL_EC_NIST2NID
1200 && (nid = EC_curve_nist2nid(CCS exp_curve)) == NID_undef
1201 # endif
1202 )
1203 {
1204 tls_error(string_sprintf("Unknown curve name tls_eccurve '%s'", exp_curve),
1205 host, NULL, errstr);
1206 return FALSE;
1207 }
1208
1209 if (!(ecdh = EC_KEY_new_by_curve_name(nid)))
1210 {
1211 tls_error(US"Unable to create ec curve", host, NULL, errstr);
1212 return FALSE;
1213 }
1214
1215 /* The "tmp" in the name here refers to setting a temporary key
1216 not to the stability of the interface. */
1217
1218 if ((rv = SSL_CTX_set_tmp_ecdh(sctx, ecdh) == 0))
1219 tls_error(string_sprintf("Error enabling '%s' curve", exp_curve), host, NULL, errstr);
1220 else
1221 DEBUG(D_tls) debug_printf("ECDH: enabled '%s' curve\n", exp_curve);
1222
1223 EC_KEY_free(ecdh);
1224 return !rv;
1225
1226 # endif /*EXIM_HAVE_ECDH*/
1227 #endif /*OPENSSL_NO_ECDH*/
1228 }
1229
1230
1231
1232
1233 #ifndef DISABLE_OCSP
1234 /*************************************************
1235 * Load OCSP information into state *
1236 *************************************************/
1237 /* Called to load the server OCSP response from the given file into memory, once
1238 caller has determined this is needed. Checks validity. Debugs a message
1239 if invalid.
1240
1241 ASSUMES: single response, for single cert.
1242
1243 Arguments:
1244 sctx the SSL_CTX* to update
1245 cbinfo various parts of session state
1246 filename the filename putatively holding an OCSP response
1247 is_pem file is PEM format; otherwise is DER
1248
1249 */
1250
1251 static void
1252 ocsp_load_response(SSL_CTX * sctx, tls_ext_ctx_cb * cbinfo,
1253 const uschar * filename, BOOL is_pem)
1254 {
1255 BIO * bio;
1256 OCSP_RESPONSE * resp;
1257 OCSP_BASICRESP * basic_response;
1258 OCSP_SINGLERESP * single_response;
1259 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
1260 STACK_OF(X509) * sk;
1261 unsigned long verify_flags;
1262 int status, reason, i;
1263
1264 DEBUG(D_tls)
1265 debug_printf("tls_ocsp_file (%s) '%s'\n", is_pem ? "PEM" : "DER", filename);
1266
1267 if (!(bio = BIO_new_file(CS filename, "rb")))
1268 {
1269 DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
1270 filename);
1271 return;
1272 }
1273
1274 if (is_pem)
1275 {
1276 uschar * data, * freep;
1277 char * dummy;
1278 long len;
1279 if (!PEM_read_bio(bio, &dummy, &dummy, &data, &len))
1280 {
1281 DEBUG(D_tls) debug_printf("Failed to read PEM file \"%s\"\n",
1282 filename);
1283 return;
1284 }
1285 debug_printf("read pem file\n");
1286 freep = data;
1287 resp = d2i_OCSP_RESPONSE(NULL, CUSS &data, len);
1288 OPENSSL_free(freep);
1289 }
1290 else
1291 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
1292 BIO_free(bio);
1293
1294 if (!resp)
1295 {
1296 DEBUG(D_tls) debug_printf("Error reading OCSP response.\n");
1297 return;
1298 }
1299
1300 if ((status = OCSP_response_status(resp)) != OCSP_RESPONSE_STATUS_SUCCESSFUL)
1301 {
1302 DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
1303 OCSP_response_status_str(status), status);
1304 goto bad;
1305 }
1306
1307 #ifdef notdef
1308 {
1309 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
1310 OCSP_RESPONSE_print(bp, resp, 0); /* extreme debug: stapling content */
1311 BIO_free(bp);
1312 }
1313 #endif
1314
1315 if (!(basic_response = OCSP_response_get1_basic(resp)))
1316 {
1317 DEBUG(D_tls)
1318 debug_printf("OCSP response parse error: unable to extract basic response.\n");
1319 goto bad;
1320 }
1321
1322 sk = cbinfo->verify_stack;
1323 verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
1324
1325 /* May need to expose ability to adjust those flags?
1326 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
1327 OCSP_TRUSTOTHER OCSP_NOINTERN */
1328
1329 /* This does a full verify on the OCSP proof before we load it for serving
1330 up; possibly overkill - just date-checks might be nice enough.
1331
1332 OCSP_basic_verify takes a "store" arg, but does not
1333 use it for the chain verification, which is all we do
1334 when OCSP_NOVERIFY is set. The content from the wire
1335 "basic_response" and a cert-stack "sk" are all that is used.
1336
1337 We have a stack, loaded in setup_certs() if tls_verify_certificates
1338 was a file (not a directory, or "system"). It is unfortunate we
1339 cannot used the connection context store, as that would neatly
1340 handle the "system" case too, but there seems to be no library
1341 function for getting a stack from a store.
1342 [ In OpenSSL 1.1 - ? X509_STORE_CTX_get0_chain(ctx) ? ]
1343 We do not free the stack since it could be needed a second time for
1344 SNI handling.
1345
1346 Separately we might try to replace using OCSP_basic_verify() - which seems to not
1347 be a public interface into the OpenSSL library (there's no manual entry) -
1348 But what with? We also use OCSP_basic_verify in the client stapling callback.
1349 And there we NEED it; we must verify that status... unless the
1350 library does it for us anyway? */
1351
1352 if ((i = OCSP_basic_verify(basic_response, sk, NULL, verify_flags)) < 0)
1353 {
1354 DEBUG(D_tls)
1355 {
1356 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
1357 debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
1358 }
1359 goto bad;
1360 }
1361
1362 /* Here's the simplifying assumption: there's only one response, for the
1363 one certificate we use, and nothing for anything else in a chain. If this
1364 proves false, we need to extract a cert id from our issued cert
1365 (tls_certificate) and use that for OCSP_resp_find_status() (which finds the
1366 right cert in the stack and then calls OCSP_single_get0_status()).
1367
1368 I'm hoping to avoid reworking a bunch more of how we handle state here.
1369
1370 XXX that will change when we add support for (TLS1.3) whole-chain stapling
1371 */
1372
1373 if (!(single_response = OCSP_resp_get0(basic_response, 0)))
1374 {
1375 DEBUG(D_tls)
1376 debug_printf("Unable to get first response from OCSP basic response.\n");
1377 goto bad;
1378 }
1379
1380 status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
1381 if (status != V_OCSP_CERTSTATUS_GOOD)
1382 {
1383 DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
1384 OCSP_cert_status_str(status), status,
1385 OCSP_crl_reason_str(reason), reason);
1386 goto bad;
1387 }
1388
1389 if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1390 {
1391 DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
1392 goto bad;
1393 }
1394
1395 supply_response:
1396 /* Add the resp to the list used by tls_server_stapling_cb() */
1397 {
1398 ocsp_resplist ** op = &cbinfo->u_ocsp.server.olist, * oentry;
1399 while (oentry = *op)
1400 op = &oentry->next;
1401 *op = oentry = store_get(sizeof(ocsp_resplist), FALSE);
1402 oentry->next = NULL;
1403 oentry->resp = resp;
1404 }
1405 return;
1406
1407 bad:
1408 if (f.running_in_test_harness)
1409 {
1410 extern char ** environ;
1411 if (environ) for (uschar ** p = USS environ; *p; p++)
1412 if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
1413 {
1414 DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
1415 goto supply_response;
1416 }
1417 }
1418 return;
1419 }
1420
1421
1422 static void
1423 ocsp_free_response_list(tls_ext_ctx_cb * cbinfo)
1424 {
1425 for (ocsp_resplist * olist = cbinfo->u_ocsp.server.olist; olist;
1426 olist = olist->next)
1427 OCSP_RESPONSE_free(olist->resp);
1428 cbinfo->u_ocsp.server.olist = NULL;
1429 }
1430 #endif /*!DISABLE_OCSP*/
1431
1432
1433
1434
1435 /* Create and install a selfsigned certificate, for use in server mode */
1436
1437 static int
1438 tls_install_selfsign(SSL_CTX * sctx, uschar ** errstr)
1439 {
1440 X509 * x509 = NULL;
1441 EVP_PKEY * pkey;
1442 RSA * rsa;
1443 X509_NAME * name;
1444 uschar * where;
1445
1446 where = US"allocating pkey";
1447 if (!(pkey = EVP_PKEY_new()))
1448 goto err;
1449
1450 where = US"allocating cert";
1451 if (!(x509 = X509_new()))
1452 goto err;
1453
1454 where = US"generating pkey";
1455 if (!(rsa = rsa_callback(NULL, 0, 2048)))
1456 goto err;
1457
1458 where = US"assigning pkey";
1459 if (!EVP_PKEY_assign_RSA(pkey, rsa))
1460 goto err;
1461
1462 X509_set_version(x509, 2); /* N+1 - version 3 */
1463 ASN1_INTEGER_set(X509_get_serialNumber(x509), 1);
1464 X509_gmtime_adj(X509_get_notBefore(x509), 0);
1465 X509_gmtime_adj(X509_get_notAfter(x509), (long)60 * 60); /* 1 hour */
1466 X509_set_pubkey(x509, pkey);
1467
1468 name = X509_get_subject_name(x509);
1469 X509_NAME_add_entry_by_txt(name, "C",
1470 MBSTRING_ASC, CUS "UK", -1, -1, 0);
1471 X509_NAME_add_entry_by_txt(name, "O",
1472 MBSTRING_ASC, CUS "Exim Developers", -1, -1, 0);
1473 X509_NAME_add_entry_by_txt(name, "CN",
1474 MBSTRING_ASC, CUS smtp_active_hostname, -1, -1, 0);
1475 X509_set_issuer_name(x509, name);
1476
1477 where = US"signing cert";
1478 if (!X509_sign(x509, pkey, EVP_md5()))
1479 goto err;
1480
1481 where = US"installing selfsign cert";
1482 if (!SSL_CTX_use_certificate(sctx, x509))
1483 goto err;
1484
1485 where = US"installing selfsign key";
1486 if (!SSL_CTX_use_PrivateKey(sctx, pkey))
1487 goto err;
1488
1489 return OK;
1490
1491 err:
1492 (void) tls_error(where, NULL, NULL, errstr);
1493 if (x509) X509_free(x509);
1494 if (pkey) EVP_PKEY_free(pkey);
1495 return DEFER;
1496 }
1497
1498
1499
1500
1501 static int
1502 tls_add_certfile(SSL_CTX * sctx, tls_ext_ctx_cb * cbinfo, uschar * file,
1503 uschar ** errstr)
1504 {
1505 DEBUG(D_tls) debug_printf("tls_certificate file '%s'\n", file);
1506 if (!SSL_CTX_use_certificate_chain_file(sctx, CS file))
1507 return tls_error(string_sprintf(
1508 "SSL_CTX_use_certificate_chain_file file=%s", file),
1509 cbinfo->host, NULL, errstr);
1510 return 0;
1511 }
1512
1513 static int
1514 tls_add_pkeyfile(SSL_CTX * sctx, tls_ext_ctx_cb * cbinfo, uschar * file,
1515 uschar ** errstr)
1516 {
1517 DEBUG(D_tls) debug_printf("tls_privatekey file '%s'\n", file);
1518 if (!SSL_CTX_use_PrivateKey_file(sctx, CS file, SSL_FILETYPE_PEM))
1519 return tls_error(string_sprintf(
1520 "SSL_CTX_use_PrivateKey_file file=%s", file), cbinfo->host, NULL, errstr);
1521 return 0;
1522 }
1523
1524
1525 /*************************************************
1526 * Expand key and cert file specs *
1527 *************************************************/
1528
1529 /* Called once during tls_init and possibly again during TLS setup, for a
1530 new context, if Server Name Indication was used and tls_sni was seen in
1531 the certificate string.
1532
1533 Arguments:
1534 sctx the SSL_CTX* to update
1535 cbinfo various parts of session state
1536 errstr error string pointer
1537
1538 Returns: OK/DEFER/FAIL
1539 */
1540
1541 static int
1542 tls_expand_session_files(SSL_CTX * sctx, tls_ext_ctx_cb * cbinfo,
1543 uschar ** errstr)
1544 {
1545 uschar * expanded;
1546
1547 if (!cbinfo->certificate)
1548 {
1549 if (!cbinfo->is_server) /* client */
1550 return OK;
1551 /* server */
1552 if (tls_install_selfsign(sctx, errstr) != OK)
1553 return DEFER;
1554 }
1555 else
1556 {
1557 int err;
1558
1559 if ( !reexpand_tls_files_for_sni
1560 && ( Ustrstr(cbinfo->certificate, US"tls_sni")
1561 || Ustrstr(cbinfo->certificate, US"tls_in_sni")
1562 || Ustrstr(cbinfo->certificate, US"tls_out_sni")
1563 ) )
1564 reexpand_tls_files_for_sni = TRUE;
1565
1566 if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded, errstr))
1567 return DEFER;
1568
1569 if (expanded)
1570 if (cbinfo->is_server)
1571 {
1572 const uschar * file_list = expanded;
1573 int sep = 0;
1574 uschar * file;
1575 #ifndef DISABLE_OCSP
1576 const uschar * olist = cbinfo->u_ocsp.server.file;
1577 int osep = 0;
1578 uschar * ofile;
1579 BOOL fmt_pem = FALSE;
1580
1581 if (olist)
1582 if (!expand_check(olist, US"tls_ocsp_file", USS &olist, errstr))
1583 return DEFER;
1584 if (olist && !*olist)
1585 olist = NULL;
1586
1587 if ( cbinfo->u_ocsp.server.file_expanded && olist
1588 && (Ustrcmp(olist, cbinfo->u_ocsp.server.file_expanded) == 0))
1589 {
1590 DEBUG(D_tls) debug_printf(" - value unchanged, using existing values\n");
1591 olist = NULL;
1592 }
1593 else
1594 {
1595 ocsp_free_response_list(cbinfo);
1596 cbinfo->u_ocsp.server.file_expanded = olist;
1597 }
1598 #endif
1599
1600 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1601 {
1602 if ((err = tls_add_certfile(sctx, cbinfo, file, errstr)))
1603 return err;
1604
1605 #ifndef DISABLE_OCSP
1606 if (olist)
1607 if ((ofile = string_nextinlist(&olist, &osep, NULL, 0)))
1608 {
1609 if (Ustrncmp(ofile, US"PEM ", 4) == 0)
1610 {
1611 fmt_pem = TRUE;
1612 ofile += 4;
1613 }
1614 else if (Ustrncmp(ofile, US"DER ", 4) == 0)
1615 {
1616 fmt_pem = FALSE;
1617 ofile += 4;
1618 }
1619 ocsp_load_response(sctx, cbinfo, ofile, fmt_pem);
1620 }
1621 else
1622 DEBUG(D_tls) debug_printf("ran out of ocsp file list\n");
1623 #endif
1624 }
1625 }
1626 else /* would there ever be a need for multiple client certs? */
1627 if ((err = tls_add_certfile(sctx, cbinfo, expanded, errstr)))
1628 return err;
1629
1630 if ( cbinfo->privatekey
1631 && !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded, errstr))
1632 return DEFER;
1633
1634 /* If expansion was forced to fail, key_expanded will be NULL. If the result
1635 of the expansion is an empty string, ignore it also, and assume the private
1636 key is in the same file as the certificate. */
1637
1638 if (expanded && *expanded)
1639 if (cbinfo->is_server)
1640 {
1641 const uschar * file_list = expanded;
1642 int sep = 0;
1643 uschar * file;
1644
1645 while (file = string_nextinlist(&file_list, &sep, NULL, 0))
1646 if ((err = tls_add_pkeyfile(sctx, cbinfo, file, errstr)))
1647 return err;
1648 }
1649 else /* would there ever be a need for multiple client certs? */
1650 if ((err = tls_add_pkeyfile(sctx, cbinfo, expanded, errstr)))
1651 return err;
1652 }
1653
1654 return OK;
1655 }
1656
1657
1658
1659
1660 /*************************************************
1661 * Callback to handle SNI *
1662 *************************************************/
1663
1664 /* Called when acting as server during the TLS session setup if a Server Name
1665 Indication extension was sent by the client.
1666
1667 API documentation is OpenSSL s_server.c implementation.
1668
1669 Arguments:
1670 s SSL* of the current session
1671 ad unknown (part of OpenSSL API) (unused)
1672 arg Callback of "our" registered data
1673
1674 Returns: SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
1675
1676 XXX might need to change to using ClientHello callback,
1677 per https://www.openssl.org/docs/manmaster/man3/SSL_client_hello_cb_fn.html
1678 */
1679
1680 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
1681 static int
1682 tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
1683 {
1684 const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
1685 tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
1686 int rc;
1687 int old_pool = store_pool;
1688 uschar * dummy_errstr;
1689
1690 if (!servername)
1691 return SSL_TLSEXT_ERR_OK;
1692
1693 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
1694 reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
1695
1696 /* Make the extension value available for expansion */
1697 store_pool = POOL_PERM;
1698 tls_in.sni = string_copy_taint(US servername, TRUE);
1699 store_pool = old_pool;
1700
1701 if (!reexpand_tls_files_for_sni)
1702 return SSL_TLSEXT_ERR_OK;
1703
1704 /* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
1705 not confident that memcpy wouldn't break some internal reference counting.
1706 Especially since there's a references struct member, which would be off. */
1707
1708 #ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
1709 if (!(server_sni = SSL_CTX_new(TLS_server_method())))
1710 #else
1711 if (!(server_sni = SSL_CTX_new(SSLv23_server_method())))
1712 #endif
1713 {
1714 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
1715 DEBUG(D_tls) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring);
1716 goto bad;
1717 }
1718
1719 /* Not sure how many of these are actually needed, since SSL object
1720 already exists. Might even need this selfsame callback, for reneg? */
1721
1722 SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(server_ctx));
1723 SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(server_ctx));
1724 SSL_CTX_set_options(server_sni, SSL_CTX_get_options(server_ctx));
1725 SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(server_ctx));
1726 SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
1727 SSL_CTX_set_tlsext_servername_arg(server_sni, cbinfo);
1728
1729 if ( !init_dh(server_sni, cbinfo->dhparam, NULL, &dummy_errstr)
1730 || !init_ecdh(server_sni, NULL, &dummy_errstr)
1731 )
1732 goto bad;
1733
1734 if ( cbinfo->server_cipher_list
1735 && !SSL_CTX_set_cipher_list(server_sni, CS cbinfo->server_cipher_list))
1736 goto bad;
1737
1738 #ifndef DISABLE_OCSP
1739 if (cbinfo->u_ocsp.server.file)
1740 {
1741 SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
1742 SSL_CTX_set_tlsext_status_arg(server_sni, cbinfo);
1743 }
1744 #endif
1745
1746 if ((rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE,
1747 verify_callback_server, &dummy_errstr)) != OK)
1748 goto bad;
1749
1750 /* do this after setup_certs, because this can require the certs for verifying
1751 OCSP information. */
1752 if ((rc = tls_expand_session_files(server_sni, cbinfo, &dummy_errstr)) != OK)
1753 goto bad;
1754
1755 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
1756 SSL_set_SSL_CTX(s, server_sni);
1757 return SSL_TLSEXT_ERR_OK;
1758
1759 bad: return SSL_TLSEXT_ERR_ALERT_FATAL;
1760 }
1761 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
1762
1763
1764
1765
1766 #ifndef DISABLE_OCSP
1767
1768 /*************************************************
1769 * Callback to handle OCSP Stapling *
1770 *************************************************/
1771
1772 /* Called when acting as server during the TLS session setup if the client
1773 requests OCSP information with a Certificate Status Request.
1774
1775 Documentation via openssl s_server.c and the Apache patch from the OpenSSL
1776 project.
1777
1778 */
1779
1780 static int
1781 tls_server_stapling_cb(SSL *s, void *arg)
1782 {
1783 const tls_ext_ctx_cb * cbinfo = (tls_ext_ctx_cb *) arg;
1784 ocsp_resplist * olist = cbinfo->u_ocsp.server.olist;
1785 uschar * response_der; /*XXX blob */
1786 int response_der_len;
1787
1788 DEBUG(D_tls)
1789 debug_printf("Received TLS status request (OCSP stapling); %s response list\n",
1790 olist ? "have" : "lack");
1791
1792 tls_in.ocsp = OCSP_NOT_RESP;
1793 if (!olist)
1794 return SSL_TLSEXT_ERR_NOACK;
1795
1796 #ifdef EXIM_HAVE_OPESSL_GET0_SERIAL
1797 {
1798 const X509 * cert_sent = SSL_get_certificate(s);
1799 const ASN1_INTEGER * cert_serial = X509_get0_serialNumber(cert_sent);
1800 const BIGNUM * cert_bn = ASN1_INTEGER_to_BN(cert_serial, NULL);
1801 const X509_NAME * cert_issuer = X509_get_issuer_name(cert_sent);
1802 uschar * chash;
1803 uint chash_len;
1804
1805 for (; olist; olist = olist->next)
1806 {
1807 OCSP_BASICRESP * bs = OCSP_response_get1_basic(olist->resp);
1808 const OCSP_SINGLERESP * single = OCSP_resp_get0(bs, 0);
1809 const OCSP_CERTID * cid = OCSP_SINGLERESP_get0_id(single);
1810 ASN1_INTEGER * res_cert_serial;
1811 const BIGNUM * resp_bn;
1812 ASN1_OCTET_STRING * res_cert_iNameHash;
1813
1814
1815 (void) OCSP_id_get0_info(&res_cert_iNameHash, NULL, NULL, &res_cert_serial,
1816 (OCSP_CERTID *) cid);
1817 resp_bn = ASN1_INTEGER_to_BN(res_cert_serial, NULL);
1818
1819 DEBUG(D_tls)
1820 {
1821 debug_printf("cert serial: %s\n", BN_bn2hex(cert_bn));
1822 debug_printf("resp serial: %s\n", BN_bn2hex(resp_bn));
1823 }
1824
1825 if (BN_cmp(cert_bn, resp_bn) == 0)
1826 {
1827 DEBUG(D_tls) debug_printf("matched serial for ocsp\n");
1828
1829 /*XXX TODO: check the rest of the list for duplicate matches.
1830 If any, need to also check the Issuer Name hash.
1831 Without this, we will provide the wrong status in the case of
1832 duplicate id. */
1833
1834 break;
1835 }
1836 DEBUG(D_tls) debug_printf("not match serial for ocsp\n");
1837 }
1838 if (!olist)
1839 {
1840 DEBUG(D_tls) debug_printf("failed to find match for ocsp\n");
1841 return SSL_TLSEXT_ERR_NOACK;
1842 }
1843 }
1844 #else
1845 if (olist->next)
1846 {
1847 DEBUG(D_tls) debug_printf("OpenSSL version too early to support multi-leaf OCSP\n");
1848 return SSL_TLSEXT_ERR_NOACK;
1849 }
1850 #endif
1851
1852 /*XXX could we do the i2d earlier, rather than during the callback? */
1853 response_der = NULL;
1854 response_der_len = i2d_OCSP_RESPONSE(olist->resp, &response_der);
1855 if (response_der_len <= 0)
1856 return SSL_TLSEXT_ERR_NOACK;
1857
1858 SSL_set_tlsext_status_ocsp_resp(server_ssl, response_der, response_der_len);
1859 tls_in.ocsp = OCSP_VFIED;
1860 return SSL_TLSEXT_ERR_OK;
1861 }
1862
1863
1864 static void
1865 time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
1866 {
1867 BIO_printf(bp, "\t%s: ", str);
1868 ASN1_GENERALIZEDTIME_print(bp, time);
1869 BIO_puts(bp, "\n");
1870 }
1871
1872 static int
1873 tls_client_stapling_cb(SSL *s, void *arg)
1874 {
1875 tls_ext_ctx_cb * cbinfo = arg;
1876 const unsigned char * p;
1877 int len;
1878 OCSP_RESPONSE * rsp;
1879 OCSP_BASICRESP * bs;
1880 int i;
1881
1882 DEBUG(D_tls) debug_printf("Received TLS status callback (OCSP stapling):\n");
1883 len = SSL_get_tlsext_status_ocsp_resp(s, &p);
1884 if(!p)
1885 {
1886 /* Expect this when we requested ocsp but got none */
1887 if (cbinfo->u_ocsp.client.verify_required && LOGGING(tls_cipher))
1888 log_write(0, LOG_MAIN, "Required TLS certificate status not received");
1889 else
1890 DEBUG(D_tls) debug_printf(" null\n");
1891 return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1892 }
1893
1894 if (!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
1895 {
1896 tls_out.ocsp = OCSP_FAILED; /*XXX should use tlsp-> to permit concurrent outbound */
1897 if (LOGGING(tls_cipher))
1898 log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
1899 else
1900 DEBUG(D_tls) debug_printf(" parse error\n");
1901 return 0;
1902 }
1903
1904 if (!(bs = OCSP_response_get1_basic(rsp)))
1905 {
1906 tls_out.ocsp = OCSP_FAILED;
1907 if (LOGGING(tls_cipher))
1908 log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
1909 else
1910 DEBUG(D_tls) debug_printf(" error parsing response\n");
1911 OCSP_RESPONSE_free(rsp);
1912 return 0;
1913 }
1914
1915 /* We'd check the nonce here if we'd put one in the request. */
1916 /* However that would defeat cacheability on the server so we don't. */
1917
1918 /* This section of code reworked from OpenSSL apps source;
1919 The OpenSSL Project retains copyright:
1920 Copyright (c) 1999 The OpenSSL Project. All rights reserved.
1921 */
1922 {
1923 BIO * bp = NULL;
1924 #ifndef EXIM_HAVE_OCSP_RESP_COUNT
1925 STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
1926 #endif
1927
1928 DEBUG(D_tls) bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
1929
1930 /*OCSP_RESPONSE_print(bp, rsp, 0); extreme debug: stapling content */
1931
1932 /* Use the chain that verified the server cert to verify the stapled info */
1933 /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
1934
1935 if ((i = OCSP_basic_verify(bs, cbinfo->verify_stack,
1936 cbinfo->u_ocsp.client.verify_store, OCSP_NOEXPLICIT)) <= 0)
1937 if (ERR_peek_error())
1938 {
1939 tls_out.ocsp = OCSP_FAILED;
1940 if (LOGGING(tls_cipher)) log_write(0, LOG_MAIN,
1941 "Received TLS cert status response, itself unverifiable: %s",
1942 ERR_reason_error_string(ERR_peek_error()));
1943 BIO_printf(bp, "OCSP response verify failure\n");
1944 ERR_print_errors(bp);
1945 OCSP_RESPONSE_print(bp, rsp, 0);
1946 goto failed;
1947 }
1948 else
1949 DEBUG(D_tls) debug_printf("no explicit trust for OCSP signing"
1950 " in the root CA certificate; ignoring\n");
1951
1952 DEBUG(D_tls) debug_printf("OCSP response well-formed and signed OK\n");
1953
1954 /*XXX So we have a good stapled OCSP status. How do we know
1955 it is for the cert of interest? OpenSSL 1.1.0 has a routine
1956 OCSP_resp_find_status() which matches on a cert id, which presumably
1957 we should use. Making an id needs OCSP_cert_id_new(), which takes
1958 issuerName, issuerKey, serialNumber. Are they all in the cert?
1959
1960 For now, carry on blindly accepting the resp. */
1961
1962 for (int idx =
1963 #ifdef EXIM_HAVE_OCSP_RESP_COUNT
1964 OCSP_resp_count(bs) - 1;
1965 #else
1966 sk_OCSP_SINGLERESP_num(sresp) - 1;
1967 #endif
1968 idx >= 0; idx--)
1969 {
1970 OCSP_SINGLERESP * single = OCSP_resp_get0(bs, idx);
1971 int status, reason;
1972 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
1973
1974 /*XXX so I can see putting a loop in here to handle a rsp with >1 singleresp
1975 - but what happens with a GnuTLS-style input?
1976
1977 we could do with a debug label for each singleresp
1978 - it has a certID with a serialNumber, but I see no API to get that
1979 */
1980 status = OCSP_single_get0_status(single, &reason, &rev,
1981 &thisupd, &nextupd);
1982
1983 DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
1984 DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
1985 if (!OCSP_check_validity(thisupd, nextupd,
1986 EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1987 {
1988 tls_out.ocsp = OCSP_FAILED;
1989 DEBUG(D_tls) ERR_print_errors(bp);
1990 log_write(0, LOG_MAIN, "Server OSCP dates invalid");
1991 goto failed;
1992 }
1993
1994 DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
1995 OCSP_cert_status_str(status));
1996 switch(status)
1997 {
1998 case V_OCSP_CERTSTATUS_GOOD:
1999 continue; /* the idx loop */
2000 case V_OCSP_CERTSTATUS_REVOKED:
2001 log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
2002 reason != -1 ? "; reason: " : "",
2003 reason != -1 ? OCSP_crl_reason_str(reason) : "");
2004 DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
2005 break;
2006 default:
2007 log_write(0, LOG_MAIN,
2008 "Server certificate status unknown, in OCSP stapling");
2009 break;
2010 }
2011
2012 goto failed;
2013 }
2014
2015 i = 1;
2016 tls_out.ocsp = OCSP_VFIED;
2017 goto good;
2018
2019 failed:
2020 tls_out.ocsp = OCSP_FAILED;
2021 i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
2022 good:
2023 BIO_free(bp);
2024 }
2025
2026 OCSP_RESPONSE_free(rsp);
2027 return i;
2028 }
2029 #endif /*!DISABLE_OCSP*/
2030
2031
2032 /*************************************************
2033 * Initialize for TLS *
2034 *************************************************/
2035
2036 static void
2037 tls_openssl_init(void)
2038 {
2039 #ifdef EXIM_NEED_OPENSSL_INIT
2040 SSL_load_error_strings(); /* basic set up */
2041 OpenSSL_add_ssl_algorithms();
2042 #endif
2043
2044 #if defined(EXIM_HAVE_SHA256) && !defined(OPENSSL_AUTO_SHA256)
2045 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
2046 list of available digests. */
2047 EVP_add_digest(EVP_sha256());
2048 #endif
2049 }
2050
2051
2052
2053 /* Called from both server and client code, to do preliminary initialization
2054 of the library. We allocate and return a context structure.
2055
2056 Arguments:
2057 ctxp returned SSL context
2058 host connected host, if client; NULL if server
2059 dhparam DH parameter file
2060 certificate certificate file
2061 privatekey private key
2062 ocsp_file file of stapling info (server); flag for require ocsp (client)
2063 addr address if client; NULL if server (for some randomness)
2064 cbp place to put allocated callback context
2065 errstr error string pointer
2066
2067 Returns: OK/DEFER/FAIL
2068 */
2069
2070 static int
2071 tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate,
2072 uschar *privatekey,
2073 #ifndef DISABLE_OCSP
2074 uschar *ocsp_file,
2075 #endif
2076 address_item *addr, tls_ext_ctx_cb ** cbp,
2077 tls_support * tlsp,
2078 uschar ** errstr)
2079 {
2080 SSL_CTX * ctx;
2081 long init_options;
2082 int rc;
2083 tls_ext_ctx_cb * cbinfo;
2084
2085 cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
2086 cbinfo->tlsp = tlsp;
2087 cbinfo->certificate = certificate;
2088 cbinfo->privatekey = privatekey;
2089 cbinfo->is_server = host==NULL;
2090 #ifndef DISABLE_OCSP
2091 cbinfo->verify_stack = NULL;
2092 if (!host)
2093 {
2094 cbinfo->u_ocsp.server.file = ocsp_file;
2095 cbinfo->u_ocsp.server.file_expanded = NULL;
2096 cbinfo->u_ocsp.server.olist = NULL;
2097 }
2098 else
2099 cbinfo->u_ocsp.client.verify_store = NULL;
2100 #endif
2101 cbinfo->dhparam = dhparam;
2102 cbinfo->server_cipher_list = NULL;
2103 cbinfo->host = host;
2104 #ifndef DISABLE_EVENT
2105 cbinfo->event_action = NULL;
2106 #endif
2107
2108 tls_openssl_init();
2109
2110 /* Create a context.
2111 The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
2112 negotiation in the different methods; as far as I can tell, the only
2113 *_{server,client}_method which allows negotiation is SSLv23, which exists even
2114 when OpenSSL is built without SSLv2 support.
2115 By disabling with openssl_options, we can let admins re-enable with the
2116 existing knob. */
2117
2118 #ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
2119 if (!(ctx = SSL_CTX_new(host ? TLS_client_method() : TLS_server_method())))
2120 #else
2121 if (!(ctx = SSL_CTX_new(host ? SSLv23_client_method() : SSLv23_server_method())))
2122 #endif
2123 return tls_error(US"SSL_CTX_new", host, NULL, errstr);
2124
2125 /* It turns out that we need to seed the random number generator this early in
2126 order to get the full complement of ciphers to work. It took me roughly a day
2127 of work to discover this by experiment.
2128
2129 On systems that have /dev/urandom, SSL may automatically seed itself from
2130 there. Otherwise, we have to make something up as best we can. Double check
2131 afterwards. */
2132
2133 if (!RAND_status())
2134 {
2135 randstuff r;
2136 gettimeofday(&r.tv, NULL);
2137 r.p = getpid();
2138
2139 RAND_seed(US (&r), sizeof(r));
2140 RAND_seed(US big_buffer, big_buffer_size);
2141 if (addr != NULL) RAND_seed(US addr, sizeof(addr));
2142
2143 if (!RAND_status())
2144 return tls_error(US"RAND_status", host,
2145 US"unable to seed random number generator", errstr);
2146 }
2147
2148 /* Set up the information callback, which outputs if debugging is at a suitable
2149 level. */
2150
2151 DEBUG(D_tls)
2152 {
2153 SSL_CTX_set_info_callback(ctx, (void (*)())info_callback);
2154 #if defined(EXIM_HAVE_OPESSL_TRACE) && !defined(OPENSSL_NO_SSL_TRACE)
2155 /* this needs a debug build of OpenSSL */
2156 SSL_CTX_set_msg_callback(ctx, (void (*)())SSL_trace);
2157 #endif
2158 #ifdef OPENSSL_HAVE_KEYLOG_CB
2159 SSL_CTX_set_keylog_callback(ctx, (void (*)())keylog_callback);
2160 #endif
2161 }
2162
2163 /* Automatically re-try reads/writes after renegotiation. */
2164 (void) SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
2165
2166 /* Apply administrator-supplied work-arounds.
2167 Historically we applied just one requested option,
2168 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
2169 moved to an administrator-controlled list of options to specify and
2170 grandfathered in the first one as the default value for "openssl_options".
2171
2172 No OpenSSL version number checks: the options we accept depend upon the
2173 availability of the option value macros from OpenSSL. */
2174
2175 if (!tls_openssl_options_parse(openssl_options, &init_options))
2176 return tls_error(US"openssl_options parsing failed", host, NULL, errstr);
2177
2178 #ifdef EXPERIMENTAL_TLS_RESUME
2179 tlsp->resumption = RESUME_SUPPORTED;
2180 #endif
2181 if (init_options)
2182 {
2183 #ifdef EXPERIMENTAL_TLS_RESUME
2184 /* Should the server offer session resumption? */
2185 if (!host && verify_check_host(&tls_resumption_hosts) == OK)
2186 {
2187 DEBUG(D_tls) debug_printf("tls_resumption_hosts overrides openssl_options\n");
2188 init_options &= ~SSL_OP_NO_TICKET;
2189 tlsp->resumption |= RESUME_SERVER_TICKET; /* server will give ticket on request */
2190 tlsp->host_resumable = TRUE;
2191 }
2192 #endif
2193
2194 DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
2195 if (!(SSL_CTX_set_options(ctx, init_options)))
2196 return tls_error(string_sprintf(
2197 "SSL_CTX_set_option(%#lx)", init_options), host, NULL, errstr);
2198 }
2199 else
2200 DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
2201
2202 /* We'd like to disable session cache unconditionally, but foolish Outlook
2203 Express clients then give up the first TLS connection and make a second one
2204 (which works). Only when there is an IMAP service on the same machine.
2205 Presumably OE is trying to use the cache for A on B. Leave it enabled for
2206 now, until we work out a decent way of presenting control to the config. It
2207 will never be used because we use a new context every time. */
2208 #ifdef notdef
2209 (void) SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
2210 #endif
2211
2212 /* Initialize with DH parameters if supplied */
2213 /* Initialize ECDH temp key parameter selection */
2214
2215 if ( !init_dh(ctx, dhparam, host, errstr)
2216 || !init_ecdh(ctx, host, errstr)
2217 )
2218 return DEFER;
2219
2220 /* Set up certificate and key (and perhaps OCSP info) */
2221
2222 if ((rc = tls_expand_session_files(ctx, cbinfo, errstr)) != OK)
2223 return rc;
2224
2225 /* If we need to handle SNI or OCSP, do so */
2226
2227 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2228 # ifndef DISABLE_OCSP
2229 if (!(cbinfo->verify_stack = sk_X509_new_null()))
2230 {
2231 DEBUG(D_tls) debug_printf("failed to create stack for stapling verify\n");
2232 return FAIL;
2233 }
2234 # endif
2235
2236 if (!host) /* server */
2237 {
2238 # ifndef DISABLE_OCSP
2239 /* We check u_ocsp.server.file, not server.olist, because we care about if
2240 the option exists, not what the current expansion might be, as SNI might
2241 change the certificate and OCSP file in use between now and the time the
2242 callback is invoked. */
2243 if (cbinfo->u_ocsp.server.file)
2244 {
2245 SSL_CTX_set_tlsext_status_cb(ctx, tls_server_stapling_cb);
2246 SSL_CTX_set_tlsext_status_arg(ctx, cbinfo);
2247 }
2248 # endif
2249 /* We always do this, so that $tls_sni is available even if not used in
2250 tls_certificate */
2251 SSL_CTX_set_tlsext_servername_callback(ctx, tls_servername_cb);
2252 SSL_CTX_set_tlsext_servername_arg(ctx, cbinfo);
2253 }
2254 # ifndef DISABLE_OCSP
2255 else /* client */
2256 if(ocsp_file) /* wanting stapling */
2257 {
2258 if (!(cbinfo->u_ocsp.client.verify_store = X509_STORE_new()))
2259 {
2260 DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
2261 return FAIL;
2262 }
2263 SSL_CTX_set_tlsext_status_cb(ctx, tls_client_stapling_cb);
2264 SSL_CTX_set_tlsext_status_arg(ctx, cbinfo);
2265 }
2266 # endif
2267 #endif
2268
2269 cbinfo->verify_cert_hostnames = NULL;
2270
2271 #ifdef EXIM_HAVE_EPHEM_RSA_KEX
2272 /* Set up the RSA callback */
2273 SSL_CTX_set_tmp_rsa_callback(ctx, rsa_callback);
2274 #endif
2275
2276 /* Finally, set the session cache timeout, and we are done.
2277 The period appears to be also used for (server-generated) session tickets */
2278
2279 SSL_CTX_set_timeout(ctx, ssl_session_timeout);
2280 DEBUG(D_tls) debug_printf("Initialized TLS\n");
2281
2282 *cbp = cbinfo;
2283 *ctxp = ctx;
2284
2285 return OK;
2286 }
2287
2288
2289
2290
2291 /*************************************************
2292 * Get name of cipher in use *
2293 *************************************************/
2294
2295 /*
2296 Argument: pointer to an SSL structure for the connection
2297 pointer to number of bits for cipher
2298 Returns: pointer to allocated string in perm-pool
2299 */
2300
2301 static uschar *
2302 construct_cipher_name(SSL * ssl, const uschar * ver, int * bits)
2303 {
2304 int pool = store_pool;
2305 /* With OpenSSL 1.0.0a, 'c' needs to be const but the documentation doesn't
2306 yet reflect that. It should be a safe change anyway, even 0.9.8 versions have
2307 the accessor functions use const in the prototype. */
2308
2309 const SSL_CIPHER * c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
2310 uschar * s;
2311
2312 SSL_CIPHER_get_bits(c, bits);
2313
2314 store_pool = POOL_PERM;
2315 s = string_sprintf("%s:%s:%u", ver, SSL_CIPHER_get_name(c), *bits);
2316 store_pool = pool;
2317 DEBUG(D_tls) debug_printf("Cipher: %s\n", s);
2318 return s;
2319 }
2320
2321
2322 /* Get IETF-standard name for ciphersuite.
2323 Argument: pointer to an SSL structure for the connection
2324 Returns: pointer to string
2325 */
2326
2327 static const uschar *
2328 cipher_stdname_ssl(SSL * ssl)
2329 {
2330 #ifdef EXIM_HAVE_OPENSSL_CIPHER_STD_NAME
2331 return CUS SSL_CIPHER_standard_name(SSL_get_current_cipher(ssl));
2332 #else
2333 ushort id = 0xffff & SSL_CIPHER_get_id(SSL_get_current_cipher(ssl));
2334 return cipher_stdname(id >> 8, id & 0xff);
2335 #endif
2336 }
2337
2338
2339 static const uschar *
2340 tlsver_name(SSL * ssl)
2341 {
2342 uschar * s, * p;
2343 int pool = store_pool;
2344
2345 store_pool = POOL_PERM;
2346 s = string_copy(US SSL_get_version(ssl));
2347 store_pool = pool;
2348 if ((p = Ustrchr(s, 'v'))) /* TLSv1.2 -> TLS1.2 */
2349 for (;; p++) if (!(*p = p[1])) break;
2350 return CUS s;
2351 }
2352
2353
2354 static void
2355 peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned siz)
2356 {
2357 /*XXX we might consider a list-of-certs variable for the cert chain.
2358 SSL_get_peer_cert_chain(SSL*). We'd need a new variable type and support
2359 in list-handling functions, also consider the difference between the entire
2360 chain and the elements sent by the peer. */
2361
2362 tlsp->peerdn = NULL;
2363
2364 /* Will have already noted peercert on a verify fail; possibly not the leaf */
2365 if (!tlsp->peercert)
2366 tlsp->peercert = SSL_get_peer_certificate(ssl);
2367 /* Beware anonymous ciphers which lead to server_cert being NULL */
2368 if (tlsp->peercert)
2369 if (!X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, siz))
2370 { DEBUG(D_tls) debug_printf("X509_NAME_oneline() error\n"); }
2371 else
2372 {
2373 int oldpool = store_pool;
2374
2375 peerdn[siz-1] = '\0'; /* paranoia */
2376 store_pool = POOL_PERM;
2377 tlsp->peerdn = string_copy(peerdn);
2378 store_pool = oldpool;
2379
2380 /* We used to set CV in the cert-verify callbacks (either plain or dane)
2381 but they don't get called on session-resumption. So use the official
2382 interface, which uses the resumed value. Unfortunately this claims verified
2383 when it actually failed but we're in try-verify mode, due to us wanting the
2384 knowlege that it failed so needing to have the callback and forcing a
2385 permissive return. If we don't force it, the TLS startup is failed.
2386 The extra bit of information is set in verify_override in the cb, stashed
2387 for resumption next to the TLS session, and used here. */
2388
2389 if (!tlsp->verify_override)
2390 tlsp->certificate_verified =
2391 #ifdef SUPPORT_DANE
2392 tlsp->dane_verified ||
2393 #endif
2394 SSL_get_verify_result(ssl) == X509_V_OK;
2395 }
2396 }
2397
2398
2399
2400
2401
2402 /*************************************************
2403 * Set up for verifying certificates *
2404 *************************************************/
2405
2406 #ifndef DISABLE_OCSP
2407 /* Load certs from file, return TRUE on success */
2408
2409 static BOOL
2410 chain_from_pem_file(const uschar * file, STACK_OF(X509) * verify_stack)
2411 {
2412 BIO * bp;
2413 X509 * x;
2414
2415 while (sk_X509_num(verify_stack) > 0)
2416 X509_free(sk_X509_pop(verify_stack));
2417
2418 if (!(bp = BIO_new_file(CS file, "r"))) return FALSE;
2419 while ((x = PEM_read_bio_X509(bp, NULL, 0, NULL)))
2420 sk_X509_push(verify_stack, x);
2421 BIO_free(bp);
2422 return TRUE;
2423 }
2424 #endif
2425
2426
2427
2428 /* Called by both client and server startup; on the server possibly
2429 repeated after a Server Name Indication.
2430
2431 Arguments:
2432 sctx SSL_CTX* to initialise
2433 certs certs file or NULL
2434 crl CRL file or NULL
2435 host NULL in a server; the remote host in a client
2436 optional TRUE if called from a server for a host in tls_try_verify_hosts;
2437 otherwise passed as FALSE
2438 cert_vfy_cb Callback function for certificate verification
2439 errstr error string pointer
2440
2441 Returns: OK/DEFER/FAIL
2442 */
2443
2444 static int
2445 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
2446 int (*cert_vfy_cb)(int, X509_STORE_CTX *), uschar ** errstr)
2447 {
2448 uschar *expcerts, *expcrl;
2449
2450 if (!expand_check(certs, US"tls_verify_certificates", &expcerts, errstr))
2451 return DEFER;
2452 DEBUG(D_tls) debug_printf("tls_verify_certificates: %s\n", expcerts);
2453
2454 if (expcerts && *expcerts)
2455 {
2456 /* Tell the library to use its compiled-in location for the system default
2457 CA bundle. Then add the ones specified in the config, if any. */
2458
2459 if (!SSL_CTX_set_default_verify_paths(sctx))
2460 return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL, errstr);
2461
2462 if (Ustrcmp(expcerts, "system") != 0)
2463 {
2464 struct stat statbuf;
2465
2466 if (Ustat(expcerts, &statbuf) < 0)
2467 {
2468 log_write(0, LOG_MAIN|LOG_PANIC,
2469 "failed to stat %s for certificates", expcerts);
2470 return DEFER;
2471 }
2472 else
2473 {
2474 uschar *file, *dir;
2475 if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
2476 { file = NULL; dir = expcerts; }
2477 else
2478 {
2479 file = expcerts; dir = NULL;
2480 #ifndef DISABLE_OCSP
2481 /* In the server if we will be offering an OCSP proof, load chain from
2482 file for verifying the OCSP proof at load time. */
2483
2484 /*XXX Glitch! The file here is tls_verify_certs: the chain for verifying the client cert.
2485 This is inconsistent with the need to verify the OCSP proof of the server cert.
2486 */
2487
2488 if ( !host
2489 && statbuf.st_size > 0
2490 && server_static_cbinfo->u_ocsp.server.file
2491 && !chain_from_pem_file(file, server_static_cbinfo->verify_stack)
2492 )
2493 {
2494 log_write(0, LOG_MAIN|LOG_PANIC,
2495 "failed to load cert chain from %s", file);
2496 return DEFER;
2497 }
2498 #endif
2499 }
2500
2501 /* If a certificate file is empty, the load function fails with an
2502 unhelpful error message. If we skip it, we get the correct behaviour (no
2503 certificates are recognized, but the error message is still misleading (it
2504 says no certificate was supplied). But this is better. */
2505
2506 if ( (!file || statbuf.st_size > 0)
2507 && !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
2508 return tls_error(US"SSL_CTX_load_verify_locations", host, NULL, errstr);
2509
2510 /* On the server load the list of CAs for which we will accept certs, for
2511 sending to the client. This is only for the one-file
2512 tls_verify_certificates variant.
2513 If a list isn't loaded into the server, but some verify locations are set,
2514 the server end appears to make a wildcard request for client certs.
2515 Meanwhile, the client library as default behaviour *ignores* the list
2516 we send over the wire - see man SSL_CTX_set_client_cert_cb.
2517 Because of this, and that the dir variant is likely only used for
2518 the public-CA bundle (not for a private CA), not worth fixing. */
2519
2520 if (file)
2521 {
2522 STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
2523
2524 if (!host) SSL_CTX_set_client_CA_list(sctx, names);
2525 DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n",
2526 sk_X509_NAME_num(names));
2527 }
2528 }
2529 }
2530
2531 /* Handle a certificate revocation list. */
2532
2533 #if OPENSSL_VERSION_NUMBER > 0x00907000L
2534
2535 /* This bit of code is now the version supplied by Lars Mainka. (I have
2536 merely reformatted it into the Exim code style.)
2537
2538 "From here I changed the code to add support for multiple crl's
2539 in pem format in one file or to support hashed directory entries in
2540 pem format instead of a file. This method now uses the library function
2541 X509_STORE_load_locations to add the CRL location to the SSL context.
2542 OpenSSL will then handle the verify against CA certs and CRLs by
2543 itself in the verify callback." */
2544
2545 if (!expand_check(crl, US"tls_crl", &expcrl, errstr)) return DEFER;
2546 if (expcrl && *expcrl)
2547 {
2548 struct stat statbufcrl;
2549 if (Ustat(expcrl, &statbufcrl) < 0)
2550 {
2551 log_write(0, LOG_MAIN|LOG_PANIC,
2552 "failed to stat %s for certificates revocation lists", expcrl);
2553 return DEFER;
2554 }
2555 else
2556 {
2557 /* is it a file or directory? */
2558 uschar *file, *dir;
2559 X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
2560 if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
2561 {
2562 file = NULL;
2563 dir = expcrl;
2564 DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
2565 }
2566 else
2567 {
2568 file = expcrl;
2569 dir = NULL;
2570 DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
2571 }
2572 if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
2573 return tls_error(US"X509_STORE_load_locations", host, NULL, errstr);
2574
2575 /* setting the flags to check against the complete crl chain */
2576
2577 X509_STORE_set_flags(cvstore,
2578 X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
2579 }
2580 }
2581
2582 #endif /* OPENSSL_VERSION_NUMBER > 0x00907000L */
2583
2584 /* If verification is optional, don't fail if no certificate */
2585
2586 SSL_CTX_set_verify(sctx,
2587 SSL_VERIFY_PEER | (optional ? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
2588 cert_vfy_cb);
2589 }
2590
2591 return OK;
2592 }
2593
2594
2595
2596 /*************************************************
2597 * Start a TLS session in a server *
2598 *************************************************/
2599
2600 /* This is called when Exim is running as a server, after having received
2601 the STARTTLS command. It must respond to that command, and then negotiate
2602 a TLS session.
2603
2604 Arguments:
2605 require_ciphers allowed ciphers
2606 errstr pointer to error message
2607
2608 Returns: OK on success
2609 DEFER for errors before the start of the negotiation
2610 FAIL for errors during the negotiation; the server can't
2611 continue running.
2612 */
2613
2614 int
2615 tls_server_start(const uschar * require_ciphers, uschar ** errstr)
2616 {
2617 int rc;
2618 uschar * expciphers;
2619 tls_ext_ctx_cb * cbinfo;
2620 static uschar peerdn[256];
2621
2622 /* Check for previous activation */
2623
2624 if (tls_in.active.sock >= 0)
2625 {
2626 tls_error(US"STARTTLS received after TLS started", NULL, US"", errstr);
2627 smtp_printf("554 Already in TLS\r\n", FALSE);
2628 return FAIL;
2629 }
2630
2631 /* Initialize the SSL library. If it fails, it will already have logged
2632 the error. */
2633
2634 rc = tls_init(&server_ctx, NULL, tls_dhparam, tls_certificate, tls_privatekey,
2635 #ifndef DISABLE_OCSP
2636 tls_ocsp_file,
2637 #endif
2638 NULL, &server_static_cbinfo, &tls_in, errstr);
2639 if (rc != OK) return rc;
2640 cbinfo = server_static_cbinfo;
2641
2642 if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers, errstr))
2643 return FAIL;
2644
2645 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
2646 were historically separated by underscores. So that I can use either form in my
2647 tests, and also for general convenience, we turn underscores into hyphens here.
2648
2649 XXX SSL_CTX_set_cipher_list() is replaced by SSL_CTX_set_ciphersuites()
2650 for TLS 1.3 . Since we do not call it at present we get the default list:
2651 TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
2652 */
2653
2654 if (expciphers)
2655 {
2656 for (uschar * s = expciphers; *s; s++ ) if (*s == '_') *s = '-';
2657 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
2658 if (!SSL_CTX_set_cipher_list(server_ctx, CS expciphers))
2659 return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL, errstr);
2660 cbinfo->server_cipher_list = expciphers;
2661 }
2662
2663 /* If this is a host for which certificate verification is mandatory or
2664 optional, set up appropriately. */
2665
2666 tls_in.certificate_verified = FALSE;
2667 #ifdef SUPPORT_DANE
2668 tls_in.dane_verified = FALSE;
2669 #endif
2670 server_verify_callback_called = FALSE;
2671
2672 if (verify_check_host(&tls_verify_hosts) == OK)
2673 {
2674 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
2675 FALSE, verify_callback_server, errstr);
2676 if (rc != OK) return rc;
2677 server_verify_optional = FALSE;
2678 }
2679 else if (verify_check_host(&tls_try_verify_hosts) == OK)
2680 {
2681 rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
2682 TRUE, verify_callback_server, errstr);
2683 if (rc != OK) return rc;
2684 server_verify_optional = TRUE;
2685 }
2686
2687 #ifdef EXPERIMENTAL_TLS_RESUME
2688 SSL_CTX_set_tlsext_ticket_key_cb(server_ctx, ticket_key_callback);
2689 /* despite working, appears to always return failure, so ignoring */
2690 #endif
2691 #ifdef OPENSSL_HAVE_NUM_TICKETS
2692 # ifdef EXPERIMENTAL_TLS_RESUME
2693 SSL_CTX_set_num_tickets(server_ctx, tls_in.host_resumable ? 1 : 0);
2694 # else
2695 SSL_CTX_set_num_tickets(server_ctx, 0); /* send no TLS1.3 stateful-tickets */
2696 # endif
2697 #endif
2698
2699
2700 /* Prepare for new connection */
2701
2702 if (!(server_ssl = SSL_new(server_ctx)))
2703 return tls_error(US"SSL_new", NULL, NULL, errstr);
2704
2705 /* Warning: we used to SSL_clear(ssl) here, it was removed.
2706 *
2707 * With the SSL_clear(), we get strange interoperability bugs with
2708 * OpenSSL 1.0.1b and TLS1.1/1.2. It looks as though this may be a bug in
2709 * OpenSSL itself, as a clear should not lead to inability to follow protocols.
2710 *
2711 * The SSL_clear() call is to let an existing SSL* be reused, typically after
2712 * session shutdown. In this case, we have a brand new object and there's no
2713 * obvious reason to immediately clear it. I'm guessing that this was
2714 * originally added because of incomplete initialisation which the clear fixed,
2715 * in some historic release.
2716 */
2717
2718 /* Set context and tell client to go ahead, except in the case of TLS startup
2719 on connection, where outputting anything now upsets the clients and tends to
2720 make them disconnect. We need to have an explicit fflush() here, to force out
2721 the response. Other smtp_printf() calls do not need it, because in non-TLS
2722 mode, the fflush() happens when smtp_getc() is called. */
2723
2724 SSL_set_session_id_context(server_ssl, sid_ctx, Ustrlen(sid_ctx));
2725 if (!tls_in.on_connect)
2726 {
2727 smtp_printf("220 TLS go ahead\r\n", FALSE);
2728 fflush(smtp_out);
2729 }
2730
2731 /* Now negotiate the TLS session. We put our own timer on it, since it seems
2732 that the OpenSSL library doesn't. */
2733
2734 SSL_set_wfd(server_ssl, fileno(smtp_out));
2735 SSL_set_rfd(server_ssl, fileno(smtp_in));
2736 SSL_set_accept_state(server_ssl);
2737
2738 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
2739
2740 sigalrm_seen = FALSE;
2741 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
2742 rc = SSL_accept(server_ssl);
2743 ALARM_CLR(0);
2744
2745 if (rc <= 0)
2746 {
2747 int error = SSL_get_error(server_ssl, rc);
2748 switch(error)
2749 {
2750 case SSL_ERROR_NONE:
2751 break;
2752
2753 case SSL_ERROR_ZERO_RETURN:
2754 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2755 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
2756
2757 if (SSL_get_shutdown(server_ssl) == SSL_RECEIVED_SHUTDOWN)
2758 SSL_shutdown(server_ssl);
2759
2760 tls_close(NULL, TLS_NO_SHUTDOWN);
2761 return FAIL;
2762
2763 /* Handle genuine errors */
2764 case SSL_ERROR_SSL:
2765 {
2766 uschar * s = US"SSL_accept";
2767 int r = ERR_GET_REASON(ERR_peek_error());
2768 if ( r == SSL_R_WRONG_VERSION_NUMBER || r == SSL_R_VERSION_TOO_LOW
2769 || r == SSL_R_UNKNOWN_PROTOCOL || r == SSL_R_UNSUPPORTED_PROTOCOL)
2770 s = string_sprintf("%s (%s)", s, SSL_get_version(server_ssl));
2771 (void) tls_error(s, NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
2772 return FAIL;
2773 }
2774
2775 default:
2776 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
2777 if (error == SSL_ERROR_SYSCALL)
2778 {
2779 if (!errno)
2780 {
2781 *errstr = US"SSL_accept: TCP connection closed by peer";
2782 return FAIL;
2783 }
2784 DEBUG(D_tls) debug_printf(" - syscall %s\n", strerror(errno));
2785 }
2786 (void) tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL, errstr);
2787 return FAIL;
2788 }
2789 }
2790
2791 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
2792 ERR_clear_error(); /* Even success can leave errors in the stack. Seen with
2793 anon-authentication ciphersuite negotiated. */
2794
2795 #ifdef EXPERIMENTAL_TLS_RESUME
2796 if (SSL_session_reused(server_ssl))
2797 {
2798 tls_in.resumption |= RESUME_USED;
2799 DEBUG(D_tls) debug_printf("Session reused\n");
2800 }
2801 #endif
2802
2803 /* TLS has been set up. Record data for the connection,
2804 adjust the input functions to read via TLS, and initialize things. */
2805
2806 #ifdef SSL_get_extms_support
2807 tls_in.ext_master_secret = SSL_get_extms_support(server_ssl) == 1;
2808 #endif
2809 peer_cert(server_ssl, &tls_in, peerdn, sizeof(peerdn));
2810
2811 tls_in.ver = tlsver_name(server_ssl);
2812 tls_in.cipher = construct_cipher_name(server_ssl, tls_in.ver, &tls_in.bits);
2813 tls_in.cipher_stdname = cipher_stdname_ssl(server_ssl);
2814
2815 DEBUG(D_tls)
2816 {
2817 uschar buf[2048];
2818 if (SSL_get_shared_ciphers(server_ssl, CS buf, sizeof(buf)))
2819 debug_printf("Shared ciphers: %s\n", buf);
2820
2821 #ifdef EXIM_HAVE_OPENSSL_KEYLOG
2822 {
2823 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
2824 SSL_SESSION_print_keylog(bp, SSL_get_session(server_ssl));
2825 BIO_free(bp);
2826 }
2827 #endif
2828
2829 #ifdef EXIM_HAVE_SESSION_TICKET
2830 {
2831 SSL_SESSION * ss = SSL_get_session(server_ssl);
2832 if (SSL_SESSION_has_ticket(ss)) /* 1.1.0 */
2833 debug_printf("The session has a ticket, life %lu seconds\n",
2834 SSL_SESSION_get_ticket_lifetime_hint(ss));
2835 }
2836 #endif
2837 }
2838
2839 /* Record the certificate we presented */
2840 {
2841 X509 * crt = SSL_get_certificate(server_ssl);
2842 tls_in.ourcert = crt ? X509_dup(crt) : NULL;
2843 }
2844
2845 /* Channel-binding info for authenticators
2846 See description in https://paquier.xyz/postgresql-2/channel-binding-openssl/ */
2847 {
2848 uschar c, * s;
2849 size_t len = SSL_get_peer_finished(server_ssl, &c, 0);
2850 int old_pool = store_pool;
2851
2852 SSL_get_peer_finished(server_ssl, s = store_get((int)len, FALSE), len);
2853 store_pool = POOL_PERM;
2854 tls_in.channelbinding = b64encode_taint(CUS s, (int)len, FALSE);
2855 store_pool = old_pool;
2856 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage %p\n", tls_in.channelbinding);
2857 }
2858
2859 /* Only used by the server-side tls (tls_in), including tls_getc.
2860 Client-side (tls_out) reads (seem to?) go via
2861 smtp_read_response()/ip_recv().
2862 Hence no need to duplicate for _in and _out.
2863 */
2864 if (!ssl_xfer_buffer) ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
2865 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
2866 ssl_xfer_eof = ssl_xfer_error = FALSE;
2867
2868 receive_getc = tls_getc;
2869 receive_getbuf = tls_getbuf;
2870 receive_get_cache = tls_get_cache;
2871 receive_ungetc = tls_ungetc;
2872 receive_feof = tls_feof;
2873 receive_ferror = tls_ferror;
2874 receive_smtp_buffered = tls_smtp_buffered;
2875
2876 tls_in.active.sock = fileno(smtp_out);
2877 tls_in.active.tls_ctx = NULL; /* not using explicit ctx for server-side */
2878 return OK;
2879 }
2880
2881
2882
2883
2884 static int
2885 tls_client_basic_ctx_init(SSL_CTX * ctx,
2886 host_item * host, smtp_transport_options_block * ob, tls_ext_ctx_cb * cbinfo,
2887 uschar ** errstr)
2888 {
2889 int rc;
2890 /* stick to the old behaviour for compatibility if tls_verify_certificates is
2891 set but both tls_verify_hosts and tls_try_verify_hosts is not set. Check only
2892 the specified host patterns if one of them is defined */
2893
2894 if ( ( !ob->tls_verify_hosts
2895 && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2896 )
2897 || verify_check_given_host(CUSS &ob->tls_verify_hosts, host) == OK
2898 )
2899 client_verify_optional = FALSE;
2900 else if (verify_check_given_host(CUSS &ob->tls_try_verify_hosts, host) == OK)
2901 client_verify_optional = TRUE;
2902 else
2903 return OK;
2904
2905 if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
2906 ob->tls_crl, host, client_verify_optional, verify_callback_client,
2907 errstr)) != OK)
2908 return rc;
2909
2910 if (verify_check_given_host(CUSS &ob->tls_verify_cert_hostnames, host) == OK)
2911 {
2912 cbinfo->verify_cert_hostnames =
2913 #ifdef SUPPORT_I18N
2914 string_domain_utf8_to_alabel(host->name, NULL);
2915 #else
2916 host->name;
2917 #endif
2918 DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
2919 cbinfo->verify_cert_hostnames);
2920 }
2921 return OK;
2922 }
2923
2924
2925 #ifdef SUPPORT_DANE
2926 static int
2927 dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa, uschar ** errstr)
2928 {
2929 dns_scan dnss;
2930 const char * hostnames[2] = { CS host->name, NULL };
2931 int found = 0;
2932
2933 if (DANESSL_init(ssl, NULL, hostnames) != 1)
2934 return tls_error(US"hostnames load", host, NULL, errstr);
2935
2936 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
2937 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2938 ) if (rr->type == T_TLSA && rr->size > 3)
2939 {
2940 const uschar * p = rr->data;
2941 uint8_t usage, selector, mtype;
2942 const char * mdname;
2943
2944 usage = *p++;
2945
2946 /* Only DANE-TA(2) and DANE-EE(3) are supported */
2947 if (usage != 2 && usage != 3) continue;
2948
2949 selector = *p++;
2950 mtype = *p++;
2951
2952 switch (mtype)
2953 {
2954 default: continue; /* Only match-types 0, 1, 2 are supported */
2955 case 0: mdname = NULL; break;
2956 case 1: mdname = "sha256"; break;
2957 case 2: mdname = "sha512"; break;
2958 }
2959
2960 found++;
2961 switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
2962 {
2963 default:
2964 return tls_error(US"tlsa load", host, NULL, errstr);
2965 case 0: /* action not taken */
2966 case 1: break;
2967 }
2968
2969 tls_out.tlsa_usage |= 1<<usage;
2970 }
2971
2972 if (found)
2973 return OK;
2974
2975 log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
2976 return DEFER;
2977 }
2978 #endif /*SUPPORT_DANE*/
2979
2980
2981
2982 #ifdef EXPERIMENTAL_TLS_RESUME
2983 /* On the client, get any stashed session for the given IP from hints db
2984 and apply it to the ssl-connection for attempted resumption. */
2985
2986 static void
2987 tls_retrieve_session(tls_support * tlsp, SSL * ssl, const uschar * key)
2988 {
2989 tlsp->resumption |= RESUME_SUPPORTED;
2990 if (tlsp->host_resumable)
2991 {
2992 dbdata_tls_session * dt;
2993 int len;
2994 open_db dbblock, * dbm_file;
2995
2996 tlsp->resumption |= RESUME_CLIENT_REQUESTED;
2997 DEBUG(D_tls) debug_printf("checking for resumable session for %s\n", key);
2998 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
2999 {
3000 /* key for the db is the IP */
3001 if ((dt = dbfn_read_with_length(dbm_file, key, &len)))
3002 {
3003 SSL_SESSION * ss = NULL;
3004 const uschar * sess_asn1 = dt->session;
3005
3006 len -= sizeof(dbdata_tls_session);
3007 if (!(d2i_SSL_SESSION(&ss, &sess_asn1, (long)len)))
3008 {
3009 DEBUG(D_tls)
3010 {
3011 ERR_error_string_n(ERR_get_error(),
3012 ssl_errstring, sizeof(ssl_errstring));
3013 debug_printf("decoding session: %s\n", ssl_errstring);
3014 }
3015 }
3016 #ifdef EXIM_HAVE_SESSION_TICKET
3017 else if ( SSL_SESSION_get_ticket_lifetime_hint(ss) + dt->time_stamp
3018 < time(NULL))
3019 {
3020 DEBUG(D_tls) debug_printf("session expired\n");
3021 dbfn_delete(dbm_file, key);
3022 }
3023 #endif
3024 else if (!SSL_set_session(ssl, ss))
3025 {
3026 DEBUG(D_tls)
3027 {
3028 ERR_error_string_n(ERR_get_error(),
3029 ssl_errstring, sizeof(ssl_errstring));
3030 debug_printf("applying session to ssl: %s\n", ssl_errstring);
3031 }
3032 }
3033 else
3034 {
3035 DEBUG(D_tls) debug_printf("good session\n");
3036 tlsp->resumption |= RESUME_CLIENT_SUGGESTED;
3037 tlsp->verify_override = dt->verify_override;
3038 tlsp->ocsp = dt->ocsp;
3039 }
3040 }
3041 else
3042 DEBUG(D_tls) debug_printf("no session record\n");
3043 dbfn_close(dbm_file);
3044 }
3045 }
3046 }
3047
3048
3049 /* On the client, save the session for later resumption */
3050
3051 static int
3052 tls_save_session_cb(SSL * ssl, SSL_SESSION * ss)
3053 {
3054 tls_ext_ctx_cb * cbinfo = SSL_get_ex_data(ssl, tls_exdata_idx);
3055 tls_support * tlsp;
3056
3057 DEBUG(D_tls) debug_printf("tls_save_session_cb\n");
3058
3059 if (!cbinfo || !(tlsp = cbinfo->tlsp)->host_resumable) return 0;
3060
3061 # ifdef OPENSSL_HAVE_NUM_TICKETS
3062 if (SSL_SESSION_is_resumable(ss)) /* 1.1.1 */
3063 # endif
3064 {
3065 int len = i2d_SSL_SESSION(ss, NULL);
3066 int dlen = sizeof(dbdata_tls_session) + len;
3067 dbdata_tls_session * dt = store_get(dlen, TRUE);
3068 uschar * s = dt->session;
3069 open_db dbblock, * dbm_file;
3070
3071 DEBUG(D_tls) debug_printf("session is resumable\n");
3072 tlsp->resumption |= RESUME_SERVER_TICKET; /* server gave us a ticket */
3073
3074 dt->verify_override = tlsp->verify_override;
3075 dt->ocsp = tlsp->ocsp;
3076 (void) i2d_SSL_SESSION(ss, &s); /* s gets bumped to end */
3077
3078 if ((dbm_file = dbfn_open(US"tls", O_RDWR, &dbblock, FALSE, FALSE)))
3079 {
3080 const uschar * key = cbinfo->host->address;
3081 dbfn_delete(dbm_file, key);
3082 dbfn_write(dbm_file, key, dt, dlen);
3083 dbfn_close(dbm_file);
3084 DEBUG(D_tls) debug_printf("wrote session (len %u) to db\n",
3085 (unsigned)dlen);
3086 }
3087 }
3088 return 1;
3089 }
3090
3091
3092 static void
3093 tls_client_ctx_resume_prehandshake(
3094 exim_openssl_client_tls_ctx * exim_client_ctx, tls_support * tlsp,
3095 smtp_transport_options_block * ob, host_item * host)
3096 {
3097 /* Should the client request a session resumption ticket? */
3098 if (verify_check_given_host(CUSS &ob->tls_resumption_hosts, host) == OK)
3099 {
3100 tlsp->host_resumable = TRUE;
3101
3102 SSL_CTX_set_session_cache_mode(exim_client_ctx->ctx,
3103 SSL_SESS_CACHE_CLIENT
3104 | SSL_SESS_CACHE_NO_INTERNAL | SSL_SESS_CACHE_NO_AUTO_CLEAR);
3105 SSL_CTX_sess_set_new_cb(exim_client_ctx->ctx, tls_save_session_cb);
3106 }
3107 }
3108
3109 static BOOL
3110 tls_client_ssl_resume_prehandshake(SSL * ssl, tls_support * tlsp,
3111 host_item * host, uschar ** errstr)
3112 {
3113 if (tlsp->host_resumable)
3114 {
3115 DEBUG(D_tls)
3116 debug_printf("tls_resumption_hosts overrides openssl_options, enabling tickets\n");
3117 SSL_clear_options(ssl, SSL_OP_NO_TICKET);
3118
3119 tls_exdata_idx = SSL_get_ex_new_index(0, 0, 0, 0, 0);
3120 if (!SSL_set_ex_data(ssl, tls_exdata_idx, client_static_cbinfo))
3121 {
3122 tls_error(US"set ex_data", host, NULL, errstr);
3123 return FALSE;
3124 }
3125 debug_printf("tls_exdata_idx %d cbinfo %p\n", tls_exdata_idx, client_static_cbinfo);
3126 }
3127
3128 tlsp->resumption = RESUME_SUPPORTED;
3129 /* Pick up a previous session, saved on an old ticket */
3130 tls_retrieve_session(tlsp, ssl, host->address);
3131 return TRUE;
3132 }
3133
3134 static void
3135 tls_client_resume_posthandshake(exim_openssl_client_tls_ctx * exim_client_ctx,
3136 tls_support * tlsp)
3137 {
3138 if (SSL_session_reused(exim_client_ctx->ssl))
3139 {
3140 DEBUG(D_tls) debug_printf("The session was reused\n");
3141 tlsp->resumption |= RESUME_USED;
3142 }
3143 }
3144 #endif /* EXPERIMENTAL_TLS_RESUME */
3145
3146
3147 /*************************************************
3148 * Start a TLS session in a client *
3149 *************************************************/
3150
3151 /* Called from the smtp transport after STARTTLS has been accepted.
3152
3153 Arguments:
3154 cctx connection context
3155 conn_args connection details
3156 cookie datum for randomness; can be NULL
3157 tlsp record details of TLS channel configuration here; must be non-NULL
3158 errstr error string pointer
3159
3160 Returns: TRUE for success with TLS session context set in connection context,
3161 FALSE on error
3162 */
3163
3164 BOOL
3165 tls_client_start(client_conn_ctx * cctx, smtp_connect_args * conn_args,
3166 void * cookie, tls_support * tlsp, uschar ** errstr)
3167 {
3168 host_item * host = conn_args->host; /* for msgs and option-tests */
3169 transport_instance * tb = conn_args->tblock; /* always smtp or NULL */
3170 smtp_transport_options_block * ob = tb
3171 ? (smtp_transport_options_block *)tb->options_block
3172 : &smtp_transport_option_defaults;
3173 exim_openssl_client_tls_ctx * exim_client_ctx;
3174 uschar * expciphers;
3175 int rc;
3176 static uschar peerdn[256];
3177
3178 #ifndef DISABLE_OCSP
3179 BOOL request_ocsp = FALSE;
3180 BOOL require_ocsp = FALSE;
3181 #endif
3182
3183 rc = store_pool;
3184 store_pool = POOL_PERM;
3185 exim_client_ctx = store_get(sizeof(exim_openssl_client_tls_ctx), FALSE);
3186 exim_client_ctx->corked = NULL;
3187 store_pool = rc;
3188
3189 #ifdef SUPPORT_DANE
3190 tlsp->tlsa_usage = 0;
3191 #endif
3192
3193 #ifndef DISABLE_OCSP
3194 {
3195 # ifdef SUPPORT_DANE
3196 if ( conn_args->dane
3197 && ob->hosts_request_ocsp[0] == '*'
3198 && ob->hosts_request_ocsp[1] == '\0'
3199 )
3200 {
3201 /* Unchanged from default. Use a safer one under DANE */
3202 request_ocsp = TRUE;
3203 ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
3204 " {= {4}{$tls_out_tlsa_usage}} } "
3205 " {*}{}}";
3206 }
3207 # endif
3208
3209 if ((require_ocsp =
3210 verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK))
3211 request_ocsp = TRUE;
3212 else
3213 # ifdef SUPPORT_DANE
3214 if (!request_ocsp)
3215 # endif
3216 request_ocsp =
3217 verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
3218 }
3219 #endif
3220
3221 rc = tls_init(&exim_client_ctx->ctx, host, NULL,
3222 ob->tls_certificate, ob->tls_privatekey,
3223 #ifndef DISABLE_OCSP
3224 (void *)(long)request_ocsp,
3225 #endif
3226 cookie, &client_static_cbinfo, tlsp, errstr);
3227 if (rc != OK) return FALSE;
3228
3229 tlsp->certificate_verified = FALSE;
3230 client_verify_callback_called = FALSE;
3231
3232 expciphers = NULL;
3233 #ifdef SUPPORT_DANE
3234 if (conn_args->dane)
3235 {
3236 /* We fall back to tls_require_ciphers if unset, empty or forced failure, but
3237 other failures should be treated as problems. */
3238 if (ob->dane_require_tls_ciphers &&
3239 !expand_check(ob->dane_require_tls_ciphers, US"dane_require_tls_ciphers",
3240 &expciphers, errstr))
3241 return FALSE;
3242 if (expciphers && *expciphers == '\0')
3243 expciphers = NULL;
3244 }
3245 #endif
3246 if (!expciphers &&
3247 !expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
3248 &expciphers, errstr))
3249 return FALSE;
3250
3251 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
3252 are separated by underscores. So that I can use either form in my tests, and
3253 also for general convenience, we turn underscores into hyphens here. */
3254
3255 if (expciphers)
3256 {
3257 uschar *s = expciphers;
3258 while (*s) { if (*s == '_') *s = '-'; s++; }
3259 DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
3260 if (!SSL_CTX_set_cipher_list(exim_client_ctx->ctx, CS expciphers))
3261 {
3262 tls_error(US"SSL_CTX_set_cipher_list", host, NULL, errstr);
3263 return FALSE;
3264 }
3265 }
3266
3267 #ifdef SUPPORT_DANE
3268 if (conn_args->dane)
3269 {
3270 SSL_CTX_set_verify(exim_client_ctx->ctx,
3271 SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
3272 verify_callback_client_dane);
3273
3274 if (!DANESSL_library_init())
3275 {
3276 tls_error(US"library init", host, NULL, errstr);
3277 return FALSE;
3278 }
3279 if (DANESSL_CTX_init(exim_client_ctx->ctx) <= 0)
3280 {
3281 tls_error(US"context init", host, NULL, errstr);
3282 return FALSE;
3283 }
3284 }
3285 else
3286
3287 #endif
3288
3289 if (tls_client_basic_ctx_init(exim_client_ctx->ctx, host, ob,
3290 client_static_cbinfo, errstr) != OK)
3291 return FALSE;
3292
3293 #ifdef EXPERIMENTAL_TLS_RESUME
3294 tls_client_ctx_resume_prehandshake(exim_client_ctx, tlsp, ob, host);
3295 #endif
3296
3297
3298 if (!(exim_client_ctx->ssl = SSL_new(exim_client_ctx->ctx)))
3299 {
3300 tls_error(US"SSL_new", host, NULL, errstr);
3301 return FALSE;
3302 }
3303 SSL_set_session_id_context(exim_client_ctx->ssl, sid_ctx, Ustrlen(sid_ctx));
3304
3305 SSL_set_fd(exim_client_ctx->ssl, cctx->sock);
3306 SSL_set_connect_state(exim_client_ctx->ssl);
3307
3308 if (ob->tls_sni)
3309 {
3310 if (!expand_check(ob->tls_sni, US"tls_sni", &tlsp->sni, errstr))
3311 return FALSE;
3312 if (!tlsp->sni)
3313 {
3314 DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
3315 }
3316 else if (!Ustrlen(tlsp->sni))
3317 tlsp->sni = NULL;
3318 else
3319 {
3320 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
3321 DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tlsp->sni);
3322 SSL_set_tlsext_host_name(exim_client_ctx->ssl, tlsp->sni);
3323 #else
3324 log_write(0, LOG_MAIN, "SNI unusable with this OpenSSL library version; ignoring \"%s\"\n",
3325 tlsp->sni);
3326 #endif
3327 }
3328 }
3329
3330 #ifdef SUPPORT_DANE
3331 if (conn_args->dane)
3332 if (dane_tlsa_load(exim_client_ctx->ssl, host, &conn_args->tlsa_dnsa, errstr) != OK)
3333 return FALSE;
3334 #endif
3335
3336 #ifndef DISABLE_OCSP
3337 /* Request certificate status at connection-time. If the server
3338 does OCSP stapling we will get the callback (set in tls_init()) */
3339 # ifdef SUPPORT_DANE
3340 if (request_ocsp)
3341 {
3342 const uschar * s;
3343 if ( ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
3344 || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
3345 )
3346 { /* Re-eval now $tls_out_tlsa_usage is populated. If
3347 this means we avoid the OCSP request, we wasted the setup
3348 cost in tls_init(). */
3349 require_ocsp = verify_check_given_host(CUSS &ob->hosts_require_ocsp, host) == OK;
3350 request_ocsp = require_ocsp
3351 || verify_check_given_host(CUSS &ob->hosts_request_ocsp, host) == OK;
3352 }
3353 }
3354 # endif
3355
3356 if (request_ocsp)
3357 {
3358 SSL_set_tlsext_status_type(exim_client_ctx->ssl, TLSEXT_STATUSTYPE_ocsp);
3359 client_static_cbinfo->u_ocsp.client.verify_required = require_ocsp;
3360 tlsp->ocsp = OCSP_NOT_RESP;
3361 }
3362 #endif
3363
3364 #ifdef EXPERIMENTAL_TLS_RESUME
3365 if (!tls_client_ssl_resume_prehandshake(exim_client_ctx->ssl, tlsp, host,
3366 errstr))
3367 return FALSE;
3368 #endif
3369
3370 #ifndef DISABLE_EVENT
3371 client_static_cbinfo->event_action = tb ? tb->event_action : NULL;
3372 #endif
3373
3374 /* There doesn't seem to be a built-in timeout on connection. */
3375
3376 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
3377 sigalrm_seen = FALSE;
3378 ALARM(ob->command_timeout);
3379 rc = SSL_connect(exim_client_ctx->ssl);
3380 ALARM_CLR(0);
3381
3382 #ifdef SUPPORT_DANE
3383 if (conn_args->dane)
3384 DANESSL_cleanup(exim_client_ctx->ssl);
3385 #endif
3386
3387 if (rc <= 0)
3388 {
3389 tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL, errstr);
3390 return FALSE;
3391 }
3392
3393 DEBUG(D_tls)
3394 {
3395 debug_printf("SSL_connect succeeded\n");
3396 #ifdef EXIM_HAVE_OPENSSL_KEYLOG
3397 {
3398 BIO * bp = BIO_new_fp(debug_file, BIO_NOCLOSE);
3399 SSL_SESSION_print_keylog(bp, SSL_get_session(exim_client_ctx->ssl));
3400 BIO_free(bp);
3401 }
3402 #endif
3403 }
3404
3405 #ifdef EXPERIMENTAL_TLS_RESUME
3406 tls_client_resume_posthandshake(exim_client_ctx, tlsp);
3407 #endif
3408
3409 #ifdef SSL_get_extms_support
3410 tlsp->ext_master_secret = SSL_get_extms_support(exim_client_ctx->ssl) == 1;
3411 #endif
3412 peer_cert(exim_client_ctx->ssl, tlsp, peerdn, sizeof(peerdn));
3413
3414 tlsp->ver = tlsver_name(exim_client_ctx->ssl);
3415 tlsp->cipher = construct_cipher_name(exim_client_ctx->ssl, tlsp->ver, &tlsp->bits);
3416 tlsp->cipher_stdname = cipher_stdname_ssl(exim_client_ctx->ssl);
3417
3418 /* Record the certificate we presented */
3419 {
3420 X509 * crt = SSL_get_certificate(exim_client_ctx->ssl);
3421 tlsp->ourcert = crt ? X509_dup(crt) : NULL;
3422 }
3423
3424 /*XXX will this work with continued-TLS? */
3425 /* Channel-binding info for authenticators */
3426 {
3427 uschar c, * s;
3428 size_t len = SSL_get_finished(exim_client_ctx->ssl, &c, 0);
3429 int old_pool = store_pool;
3430
3431 SSL_get_finished(exim_client_ctx->ssl, s = store_get((int)len, TRUE), len);
3432 store_pool = POOL_PERM;
3433 tlsp->channelbinding = b64encode_taint(CUS s, (int)len, TRUE);
3434 store_pool = old_pool;
3435 DEBUG(D_tls) debug_printf("Have channel bindings cached for possible auth usage %p %p\n", tlsp->channelbinding, tlsp);
3436 }
3437
3438 tlsp->active.sock = cctx->sock;
3439 tlsp->active.tls_ctx = exim_client_ctx;
3440 cctx->tls_ctx = exim_client_ctx;
3441 return TRUE;
3442 }
3443
3444
3445
3446
3447
3448 static BOOL
3449 tls_refill(unsigned lim)
3450 {
3451 int error;
3452 int inbytes;
3453
3454 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", server_ssl,
3455 ssl_xfer_buffer, ssl_xfer_buffer_size);
3456
3457 if (smtp_receive_timeout > 0) ALARM(smtp_receive_timeout);
3458 inbytes = SSL_read(server_ssl, CS ssl_xfer_buffer,
3459 MIN(ssl_xfer_buffer_size, lim));
3460 error = SSL_get_error(server_ssl, inbytes);
3461 if (smtp_receive_timeout > 0) ALARM_CLR(0);
3462
3463 if (had_command_timeout) /* set by signal handler */
3464 smtp_command_timeout_exit(); /* does not return */
3465 if (had_command_sigterm)
3466 smtp_command_sigterm_exit();
3467 if (had_data_timeout)
3468 smtp_data_timeout_exit();
3469 if (had_data_sigint)
3470 smtp_data_sigint_exit();
3471
3472 /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
3473 closed down, not that the socket itself has been closed down. Revert to
3474 non-SSL handling. */
3475
3476 switch(error)
3477 {
3478 case SSL_ERROR_NONE:
3479 break;
3480
3481 case SSL_ERROR_ZERO_RETURN:
3482 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
3483
3484 if (SSL_get_shutdown(server_ssl) == SSL_RECEIVED_SHUTDOWN)
3485 SSL_shutdown(server_ssl);
3486
3487 tls_close(NULL, TLS_NO_SHUTDOWN);
3488 return FALSE;
3489
3490 /* Handle genuine errors */
3491 case SSL_ERROR_SSL:
3492 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
3493 log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
3494 ssl_xfer_error = TRUE;
3495 return FALSE;
3496
3497 default:
3498 DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
3499 DEBUG(D_tls) if (error == SSL_ERROR_SYSCALL)
3500 debug_printf(" - syscall %s\n", strerror(errno));
3501 ssl_xfer_error = TRUE;
3502 return FALSE;
3503 }
3504
3505 #ifndef DISABLE_DKIM
3506 dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
3507 #endif
3508 ssl_xfer_buffer_hwm = inbytes;
3509 ssl_xfer_buffer_lwm = 0;
3510 return TRUE;
3511 }
3512
3513
3514 /*************************************************
3515 * TLS version of getc *
3516 *************************************************/
3517
3518 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
3519 it refills the buffer via the SSL reading function.
3520
3521 Arguments: lim Maximum amount to read/buffer
3522 Returns: the next character or EOF
3523
3524 Only used by the server-side TLS.
3525 */
3526
3527 int
3528 tls_getc(unsigned lim)
3529 {
3530 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
3531 if (!tls_refill(lim))
3532 return ssl_xfer_error ? EOF : smtp_getc(lim);
3533
3534 /* Something in the buffer; return next uschar */
3535
3536 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
3537 }
3538
3539 uschar *
3540 tls_getbuf(unsigned * len)
3541 {
3542 unsigned size;
3543 uschar * buf;
3544
3545 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
3546 if (!tls_refill(*len))
3547 {
3548 if (!ssl_xfer_error) return smtp_getbuf(len);
3549 *len = 0;
3550 return NULL;
3551 }
3552
3553 if ((size = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm) > *len)
3554 size = *len;
3555 buf = &ssl_xfer_buffer[ssl_xfer_buffer_lwm];
3556 ssl_xfer_buffer_lwm += size;
3557 *len = size;
3558 return buf;
3559 }
3560
3561
3562 void
3563 tls_get_cache()
3564 {
3565 #ifndef DISABLE_DKIM
3566 int n = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm;
3567 if (n > 0)
3568 dkim_exim_verify_feed(ssl_xfer_buffer+ssl_xfer_buffer_lwm, n);
3569 #endif
3570 }
3571
3572
3573 BOOL
3574 tls_could_read(void)
3575 {
3576 return ssl_xfer_buffer_lwm < ssl_xfer_buffer_hwm || SSL_pending(server_ssl) > 0;
3577 }
3578
3579
3580 /*************************************************
3581 * Read bytes from TLS channel *
3582 *************************************************/
3583
3584 /*
3585 Arguments:
3586 ct_ctx client context pointer, or NULL for the one global server context
3587 buff buffer of data
3588 len size of buffer
3589
3590 Returns: the number of bytes read
3591 -1 after a failed read, including EOF
3592
3593 Only used by the client-side TLS.
3594 */
3595
3596 int
3597 tls_read(void * ct_ctx, uschar *buff, size_t len)
3598 {
3599 SSL * ssl = ct_ctx ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl : server_ssl;
3600 int inbytes;
3601 int error;
3602
3603 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
3604 buff, (unsigned int)len);
3605
3606 inbytes = SSL_read(ssl, CS buff, len);
3607 error = SSL_get_error(ssl, inbytes);
3608
3609 if (error == SSL_ERROR_ZERO_RETURN)
3610 {
3611 DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
3612 return -1;
3613 }
3614 else if (error != SSL_ERROR_NONE)
3615 return -1;
3616
3617 return inbytes;
3618 }
3619
3620
3621
3622
3623
3624 /*************************************************
3625 * Write bytes down TLS channel *
3626 *************************************************/
3627
3628 /*
3629 Arguments:
3630 ct_ctx client context pointer, or NULL for the one global server context
3631 buff buffer of data
3632 len number of bytes
3633 more further data expected soon
3634
3635 Returns: the number of bytes after a successful write,
3636 -1 after a failed write
3637
3638 Used by both server-side and client-side TLS. Calling with len zero and more unset
3639 will flush buffered writes; buff can be null for this case.
3640 */
3641
3642 int
3643 tls_write(void * ct_ctx, const uschar * buff, size_t len, BOOL more)
3644 {
3645 size_t olen = len;
3646 int outbytes, error;
3647 SSL * ssl = ct_ctx
3648 ? ((exim_openssl_client_tls_ctx *)ct_ctx)->ssl : server_ssl;
3649 static gstring * server_corked = NULL;
3650 gstring ** corkedp = ct_ctx
3651 ? &((exim_openssl_client_tls_ctx *)ct_ctx)->corked : &server_corked;
3652 gstring * corked = *corkedp;
3653
3654 DEBUG(D_tls) debug_printf("%s(%p, %lu%s)\n", __FUNCTION__,
3655 buff, (unsigned long)len, more ? ", more" : "");
3656
3657 /* Lacking a CORK or MSG_MORE facility (such as GnuTLS has) we copy data when
3658 "more" is notified. This hack is only ok if small amounts are involved AND only
3659 one stream does it, in one context (i.e. no store reset). Currently it is used
3660 for the responses to the received SMTP MAIL , RCPT, DATA sequence, only.
3661 We support callouts done by the server process by using a separate client
3662 context for the stashed information. */
3663 /* + if PIPE_COMMAND, banner & ehlo-resp for smmtp-on-connect. Suspect there's
3664 a store reset there, so use POOL_PERM. */
3665 /* + if CHUNKING, cmds EHLO,MAIL,RCPT(s),BDAT */
3666
3667 if ((more || corked))
3668 {
3669 if (!len) buff = US &error; /* dummy just so that string_catn is ok */
3670
3671 #ifndef DISABLE_PIPE_CONNECT
3672 int save_pool = store_pool;
3673 store_pool = POOL_PERM;
3674 #endif
3675
3676 corked = string_catn(corked, buff, len);
3677
3678 #ifndef DISABLE_PIPE_CONNECT
3679 store_pool = save_pool;
3680 #endif
3681
3682 if (more)
3683 {
3684 *corkedp = corked;
3685 return len;
3686 }
3687 buff = CUS corked->s;
3688 len = corked->ptr;
3689 *corkedp = NULL;
3690 }
3691
3692 for (int left = len; left > 0;)
3693 {
3694 DEBUG(D_tls) debug_printf("SSL_write(%p, %p, %d)\n", ssl, buff, left);
3695 outbytes = SSL_write(ssl, CS buff, left);
3696 error = SSL_get_error(ssl, outbytes);
3697 DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
3698 switch (error)
3699 {
3700 case SSL_ERROR_NONE: /* the usual case */
3701 left -= outbytes;
3702 buff += outbytes;
3703 break;
3704
3705 case SSL_ERROR_SSL:
3706 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
3707 log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
3708 return -1;
3709
3710 case SSL_ERROR_ZERO_RETURN:
3711 log_write(0, LOG_MAIN, "SSL channel closed on write");
3712 return -1;
3713
3714 case SSL_ERROR_SYSCALL:
3715 log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
3716 sender_fullhost ? sender_fullhost : US"<unknown>",
3717 strerror(errno));
3718 return -1;
3719
3720 default:
3721 log_write(0, LOG_MAIN, "SSL_write error %d", error);
3722 return -1;
3723 }
3724 }
3725 return olen;
3726 }
3727
3728
3729
3730 /*************************************************
3731 * Close down a TLS session *
3732 *************************************************/
3733
3734 /* This is also called from within a delivery subprocess forked from the
3735 daemon, to shut down the TLS library, without actually doing a shutdown (which
3736 would tamper with the SSL session in the parent process).
3737
3738 Arguments:
3739 ct_ctx client TLS context pointer, or NULL for the one global server context
3740 shutdown 1 if TLS close-alert is to be sent,
3741 2 if also response to be waited for
3742
3743 Returns: nothing
3744
3745 Used by both server-side and client-side TLS.
3746 */
3747
3748 void
3749 tls_close(void * ct_ctx, int shutdown)
3750 {
3751 exim_openssl_client_tls_ctx * o_ctx = ct_ctx;
3752 SSL_CTX **ctxp = o_ctx ? &o_ctx->ctx : &server_ctx;
3753 SSL **sslp = o_ctx ? &o_ctx->ssl : &server_ssl;
3754 int *fdp = o_ctx ? &tls_out.active.sock : &tls_in.active.sock;
3755
3756 if (*fdp < 0) return; /* TLS was not active */
3757
3758 if (shutdown)
3759 {
3760 int rc;
3761 DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
3762 shutdown > 1 ? " (with response-wait)" : "");
3763
3764 if ( (rc = SSL_shutdown(*sslp)) == 0 /* send "close notify" alert */
3765 && shutdown > 1)
3766 {
3767 ALARM(2);
3768 rc = SSL_shutdown(*sslp); /* wait for response */
3769 ALARM_CLR(0);
3770 }
3771
3772 if (rc < 0) DEBUG(D_tls)
3773 {
3774 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
3775 debug_printf("SSL_shutdown: %s\n", ssl_errstring);
3776 }
3777 }
3778
3779 if (!o_ctx) /* server side */
3780 {
3781 #ifndef DISABLE_OCSP
3782 sk_X509_pop_free(server_static_cbinfo->verify_stack, X509_free);
3783 server_static_cbinfo->verify_stack = NULL;
3784 #endif
3785
3786 receive_getc = smtp_getc;
3787 receive_getbuf = smtp_getbuf;
3788 receive_get_cache = smtp_get_cache;
3789 receive_ungetc = smtp_ungetc;
3790 receive_feof = smtp_feof;
3791 receive_ferror = smtp_ferror;
3792 receive_smtp_buffered = smtp_buffered;
3793 tls_in.active.tls_ctx = NULL;
3794 tls_in.sni = NULL;
3795 /* Leave bits, peercert, cipher, peerdn, certificate_verified set, for logging */
3796 }
3797
3798 SSL_CTX_free(*ctxp);
3799 SSL_free(*sslp);
3800 *ctxp = NULL;
3801 *sslp = NULL;
3802 *fdp = -1;
3803 }
3804
3805
3806
3807
3808 /*************************************************
3809 * Let tls_require_ciphers be checked at startup *
3810 *************************************************/
3811
3812 /* The tls_require_ciphers option, if set, must be something which the
3813 library can parse.
3814
3815 Returns: NULL on success, or error message
3816 */
3817
3818 uschar *
3819 tls_validate_require_cipher(void)
3820 {
3821 SSL_CTX *ctx;
3822 uschar *s, *expciphers, *err;
3823
3824 tls_openssl_init();
3825
3826 if (!(tls_require_ciphers && *tls_require_ciphers))
3827 return NULL;
3828
3829 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers,
3830 &err))
3831 return US"failed to expand tls_require_ciphers";
3832
3833 if (!(expciphers && *expciphers))
3834 return NULL;
3835
3836 /* normalisation ripped from above */
3837 s = expciphers;
3838 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
3839
3840 err = NULL;
3841
3842 #ifdef EXIM_HAVE_OPENSSL_TLS_METHOD
3843 if (!(ctx = SSL_CTX_new(TLS_server_method())))
3844 #else
3845 if (!(ctx = SSL_CTX_new(SSLv23_server_method())))
3846 #endif
3847 {
3848 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
3849 return string_sprintf("SSL_CTX_new() failed: %s", ssl_errstring);
3850 }
3851
3852 DEBUG(D_tls)
3853 debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
3854
3855 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
3856 {
3857 ERR_error_string_n(ERR_get_error(), ssl_errstring, sizeof(ssl_errstring));
3858 err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed: %s",
3859 expciphers, ssl_errstring);
3860 }
3861
3862 SSL_CTX_free(ctx);
3863
3864 return err;
3865 }
3866
3867
3868
3869
3870 /*************************************************
3871 * Report the library versions. *
3872 *************************************************/
3873
3874 /* There have historically been some issues with binary compatibility in
3875 OpenSSL libraries; if Exim (like many other applications) is built against
3876 one version of OpenSSL but the run-time linker picks up another version,
3877 it can result in serious failures, including crashing with a SIGSEGV. So
3878 report the version found by the compiler and the run-time version.
3879
3880 Note: some OS vendors backport security fixes without changing the version
3881 number/string, and the version date remains unchanged. The _build_ date
3882 will change, so we can more usefully assist with version diagnosis by also
3883 reporting the build date.
3884
3885 Arguments: a FILE* to print the results to
3886 Returns: nothing
3887 */
3888
3889 void
3890 tls_version_report(FILE *f)
3891 {
3892 fprintf(f, "Library version: OpenSSL: Compile: %s\n"
3893 " Runtime: %s\n"
3894 " : %s\n",
3895 OPENSSL_VERSION_TEXT,
3896 SSLeay_version(SSLEAY_VERSION),
3897 SSLeay_version(SSLEAY_BUILT_ON));
3898 /* third line is 38 characters for the %s and the line is 73 chars long;
3899 the OpenSSL output includes a "built on: " prefix already. */
3900 }
3901
3902
3903
3904
3905 /*************************************************
3906 * Random number generation *
3907 *************************************************/
3908
3909 /* Pseudo-random number generation. The result is not expected to be
3910 cryptographically strong but not so weak that someone will shoot themselves
3911 in the foot using it as a nonce in input in some email header scheme or
3912 whatever weirdness they'll twist this into. The result should handle fork()
3913 and avoid repeating sequences. OpenSSL handles that for us.
3914
3915 Arguments:
3916 max range maximum
3917 Returns a random number in range [0, max-1]
3918 */
3919
3920 int
3921 vaguely_random_number(int max)
3922 {
3923 unsigned int r;
3924 int i, needed_len;
3925 static pid_t pidlast = 0;
3926 pid_t pidnow;
3927 uschar smallbuf[sizeof(r)];
3928
3929 if (max <= 1)
3930 return 0;
3931
3932 pidnow = getpid();
3933 if (pidnow != pidlast)
3934 {
3935 /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
3936 is unique for each thread", this doesn't apparently apply across processes,
3937 so our own warning from vaguely_random_number_fallback() applies here too.
3938 Fix per PostgreSQL. */
3939 if (pidlast != 0)
3940 RAND_cleanup();
3941 pidlast = pidnow;
3942 }
3943
3944 /* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
3945 if (!RAND_status())
3946 {
3947 randstuff r;
3948 gettimeofday(&r.tv, NULL);
3949 r.p = getpid();
3950
3951 RAND_seed(US (&r), sizeof(r));
3952 }
3953 /* We're after pseudo-random, not random; if we still don't have enough data
3954 in the internal PRNG then our options are limited. We could sleep and hope
3955 for entropy to come along (prayer technique) but if the system is so depleted
3956 in the first place then something is likely to just keep taking it. Instead,
3957 we'll just take whatever little bit of pseudo-random we can still manage to
3958 get. */
3959
3960 needed_len = sizeof(r);
3961 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
3962 asked for a number less than 10. */
3963 for (r = max, i = 0; r; ++i)
3964 r >>= 1;
3965 i = (i + 7) / 8;
3966 if (i < needed_len)
3967 needed_len = i;
3968
3969 #ifdef EXIM_HAVE_RAND_PSEUDO
3970 /* We do not care if crypto-strong */
3971 i = RAND_pseudo_bytes(smallbuf, needed_len);
3972 #else
3973 i = RAND_bytes(smallbuf, needed_len);
3974 #endif
3975
3976 if (i < 0)
3977 {
3978 DEBUG(D_all)
3979 debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
3980 return vaguely_random_number_fallback(max);
3981 }
3982
3983 r = 0;
3984 for (uschar * p = smallbuf; needed_len; --needed_len, ++p)
3985 r = 256 * r + *p;
3986
3987 /* We don't particularly care about weighted results; if someone wants
3988 smooth distribution and cares enough then they should submit a patch then. */
3989 return r % max;
3990 }
3991
3992
3993
3994
3995 /*************************************************
3996 * OpenSSL option parse *
3997 *************************************************/
3998
3999 /* Parse one option for tls_openssl_options_parse below
4000
4001 Arguments:
4002 name one option name
4003 value place to store a value for it
4004 Returns success or failure in parsing
4005 */
4006
4007
4008
4009 static BOOL
4010 tls_openssl_one_option_parse(uschar *name, long *value)
4011 {
4012 int first = 0;
4013 int last = exim_openssl_options_size;
4014 while (last > first)
4015 {
4016 int middle = (first + last)/2