src/src/tls-openssl.c

   1 /*************************************************
   2 *     Exim - an Internet mail transport agent    *
   3 *************************************************/
   4
   5 /* Copyright (c) University of Cambridge 1995 - 2016 */
   6 /* See the file NOTICE for conditions of use and distribution. */
   7
   8 /* Portions Copyright (c) The OpenSSL Project 1999 */
   9
  10 /* This module provides the TLS (aka SSL) support for Exim using the OpenSSL
  11 library. It is #included into the tls.c file when that library is used. The
  12 code herein is based on a patch that was originally contributed by Steve
  13 Haslam. It was adapted from stunnel, a GPL program by Michal Trojnara.
  14
  15 No cryptographic code is included in Exim. All this module does is to call
  16 functions from the OpenSSL library. */
  17
  18
  19 /* Heading stuff */
  20
  21 #include <openssl/lhash.h>
  22 #include <openssl/ssl.h>
  23 #include <openssl/err.h>
  24 #include <openssl/rand.h>
  25 #ifndef OPENSSL_NO_ECDH
  26 # include <openssl/ec.h>
  27 #endif
  28 #ifndef DISABLE_OCSP
  29 # include <openssl/ocsp.h>
  30 #endif
  31 #ifdef EXPERIMENTAL_DANE
  32 # include <danessl.h>
  33 #endif
  34
  35
  36 #ifndef DISABLE_OCSP
  37 # define EXIM_OCSP_SKEW_SECONDS (300L)
  38 # define EXIM_OCSP_MAX_AGE (-1L)
  39 #endif
  40
  41 #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
  42 # define EXIM_HAVE_OPENSSL_TLSEXT
  43 #endif
  44 #if OPENSSL_VERSION_NUMBER >= 0x00908000L
  45 # define EXIM_HAVE_RSA_GENKEY_EX
  46 #endif
  47 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
  48 # define EXIM_HAVE_OCSP_RESP_COUNT
  49 #else
  50 # define EXIM_HAVE_EPHEM_RSA_KEX
  51 # define EXIM_HAVE_RAND_PSEUDO
  52 #endif
  53 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
  54 # define EXIM_HAVE_SHA256
  55 #endif
  56
  57 /*
  58  * X509_check_host provides sane certificate hostname checking, but was added
  59  * to OpenSSL late, after other projects forked off the code-base.  So in
  60  * addition to guarding against the base version number, beware that LibreSSL
  61  * does not (at this time) support this function.
  62  *
  63  * If LibreSSL gains a different API, perhaps via libtls, then we'll probably
  64  * opt to disentangle and ask a LibreSSL user to provide glue for a third
  65  * crypto provider for libtls instead of continuing to tie the OpenSSL glue
  66  * into even twistier knots.  If LibreSSL gains the same API, we can just
  67  * change this guard and punt the issue for a while longer.
  68  */
  69 #ifndef LIBRESSL_VERSION_NUMBER
  70 # if OPENSSL_VERSION_NUMBER >= 0x010100000L
  71 #  define EXIM_HAVE_OPENSSL_CHECKHOST
  72 # endif
  73 # if OPENSSL_VERSION_NUMBER >= 0x010000000L \
  74     && (OPENSSL_VERSION_NUMBER & 0x0000ff000L) >= 0x000002000L
  75 #  define EXIM_HAVE_OPENSSL_CHECKHOST
  76 # endif
  77 #endif
  78
  79 #if !defined(LIBRESSL_VERSION_NUMBER) \
  80     || LIBRESSL_VERSION_NUMBER >= 0x20010000L
  81 # if !defined(OPENSSL_NO_ECDH)
  82 #  if OPENSSL_VERSION_NUMBER >= 0x0090800fL
  83 #   define EXIM_HAVE_ECDH
  84 #  endif
  85 #  if OPENSSL_VERSION_NUMBER >= 0x10002000L
  86 #   if OPENSSL_VERSION_NUMBER < 0x10100000L
  87 #    define EXIM_HAVE_OPENSSL_ECDH_AUTO
  88 #   endif
  89 #   define EXIM_HAVE_OPENSSL_EC_NIST2NID
  90 #  endif
  91 # endif
  92 #endif
  93
  94 #if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
  95 # warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
  96 # define DISABLE_OCSP
  97 #endif
  98
  99 /* Structure for collecting random data for seeding. */
 100
 101 typedef struct randstuff {
 102   struct timeval tv;
 103   pid_t          p;
 104 } randstuff;
 105
 106 /* Local static variables */
 107
 108 static BOOL client_verify_callback_called = FALSE;
 109 static BOOL server_verify_callback_called = FALSE;
 110 static const uschar *sid_ctx = US"exim";
 111
 112 /* We have three different contexts to care about.
 113
 114 Simple case: client, `client_ctx`
 115  As a client, we can be doing a callout or cut-through delivery while receiving
 116  a message.  So we have a client context, which should have options initialised
 117  from the SMTP Transport.
 118
 119 Server:
 120  There are two cases: with and without ServerNameIndication from the client.
 121  Given TLS SNI, we can be using different keys, certs and various other
 122  configuration settings, because they're re-expanded with $tls_sni set.  This
 123  allows vhosting with TLS.  This SNI is sent in the handshake.
 124  A client might not send SNI, so we need a fallback, and an initial setup too.
 125  So as a server, we start out using `server_ctx`.
 126  If SNI is sent by the client, then we as server, mid-negotiation, try to clone
 127  `server_sni` from `server_ctx` and then initialise settings by re-expanding
 128  configuration.
 129 */
 130
 131 static SSL_CTX *client_ctx = NULL;
 132 static SSL_CTX *server_ctx = NULL;
 133 static SSL     *client_ssl = NULL;
 134 static SSL     *server_ssl = NULL;
 135
 136 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
 137 static SSL_CTX *server_sni = NULL;
 138 #endif
 139
 140 static char ssl_errstring[256];
 141
 142 static int  ssl_session_timeout = 200;
 143 static BOOL client_verify_optional = FALSE;
 144 static BOOL server_verify_optional = FALSE;
 145
 146 static BOOL reexpand_tls_files_for_sni = FALSE;
 147
 148
 149 typedef struct tls_ext_ctx_cb {
 150   uschar *certificate;
 151   uschar *privatekey;
 152 #ifndef DISABLE_OCSP
 153   BOOL is_server;
 154   union {
 155     struct {
 156       uschar        *file;
 157       uschar        *file_expanded;
 158       OCSP_RESPONSE *response;
 159     } server;
 160     struct {
 161       X509_STORE    *verify_store;      /* non-null if status requested */
 162       STACK_OF(X509) *verify_stack;
 163       BOOL          verify_required;
 164     } client;
 165   } u_ocsp;
 166 #endif
 167   uschar *dhparam;
 168   /* these are cached from first expand */
 169   uschar *server_cipher_list;
 170   /* only passed down to tls_error: */
 171   host_item *host;
 172   const uschar * verify_cert_hostnames;
 173 #ifndef DISABLE_EVENT
 174   uschar * event_action;
 175 #endif
 176 } tls_ext_ctx_cb;
 177
 178 /* should figure out a cleanup of API to handle state preserved per
 179 implementation, for various reasons, which can be void * in the APIs.
 180 For now, we hack around it. */
 181 tls_ext_ctx_cb *client_static_cbinfo = NULL;
 182 tls_ext_ctx_cb *server_static_cbinfo = NULL;
 183
 184 static int
 185 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
 186     int (*cert_vfy_cb)(int, X509_STORE_CTX *) );
 187
 188 /* Callbacks */
 189 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
 190 static int tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg);
 191 #endif
 192 #ifndef DISABLE_OCSP
 193 static int tls_server_stapling_cb(SSL *s, void *arg);
 194 #endif
 195
 196
 197 /*************************************************
 198 *               Handle TLS error                 *
 199 *************************************************/
 200
 201 /* Called from lots of places when errors occur before actually starting to do
 202 the TLS handshake, that is, while the session is still in clear. Always returns
 203 DEFER for a server and FAIL for a client so that most calls can use "return
 204 tls_error(...)" to do this processing and then give an appropriate return. A
 205 single function is used for both server and client, because it is called from
 206 some shared functions.
 207
 208 Argument:
 209   prefix    text to include in the logged error
 210   host      NULL if setting up a server;
 211             the connected host if setting up a client
 212   msg       error message or NULL if we should ask OpenSSL
 213
 214 Returns:    OK/DEFER/FAIL
 215 */
 216
 217 static int
 218 tls_error(uschar * prefix, const host_item * host, uschar * msg)
 219 {
 220 if (!msg)
 221   {
 222   ERR_error_string(ERR_get_error(), ssl_errstring);
 223   msg = (uschar *)ssl_errstring;
 224   }
 225
 226 if (host)
 227   {
 228   log_write(0, LOG_MAIN, "H=%s [%s] TLS error on connection (%s): %s",
 229     host->name, host->address, prefix, msg);
 230   return FAIL;
 231   }
 232 else
 233   {
 234   uschar *conn_info = smtp_get_connection_info();
 235   if (Ustrncmp(conn_info, US"SMTP ", 5) == 0)
 236     conn_info += 5;
 237   /* I'd like to get separated H= here, but too hard for now */
 238   log_write(0, LOG_MAIN, "TLS error on %s (%s): %s",
 239     conn_info, prefix, msg);
 240   return DEFER;
 241   }
 242 }
 243
 244
 245
 246 #ifdef EXIM_HAVE_EPHEM_RSA_KEX
 247 /*************************************************
 248 *        Callback to generate RSA key            *
 249 *************************************************/
 250
 251 /*
 252 Arguments:
 253   s          SSL connection
 254   export     not used
 255   keylength  keylength
 256
 257 Returns:     pointer to generated key
 258 */
 259
 260 static RSA *
 261 rsa_callback(SSL *s, int export, int keylength)
 262 {
 263 RSA *rsa_key;
 264 #ifdef EXIM_HAVE_RSA_GENKEY_EX
 265 BIGNUM *bn = BN_new();
 266 #endif
 267
 268 export = export;     /* Shut picky compilers up */
 269 DEBUG(D_tls) debug_printf("Generating %d bit RSA key...\n", keylength);
 270
 271 #ifdef EXIM_HAVE_RSA_GENKEY_EX
 272 if (  !BN_set_word(bn, (unsigned long)RSA_F4)
 273    || !(rsa_key = RSA_new())
 274    || !RSA_generate_key_ex(rsa_key, keylength, bn, NULL)
 275    )
 276 #else
 277 if (!(rsa_key = RSA_generate_key(keylength, RSA_F4, NULL, NULL)))
 278 #endif
 279
 280   {
 281   ERR_error_string(ERR_get_error(), ssl_errstring);
 282   log_write(0, LOG_MAIN|LOG_PANIC, "TLS error (RSA_generate_key): %s",
 283     ssl_errstring);
 284   return NULL;
 285   }
 286 return rsa_key;
 287 }
 288 #endif
 289
 290
 291
 292 /* Extreme debug
 293 #ifndef DISABLE_OCSP
 294 void
 295 x509_store_dump_cert_s_names(X509_STORE * store)
 296 {
 297 STACK_OF(X509_OBJECT) * roots= store->objs;
 298 int i;
 299 static uschar name[256];
 300
 301 for(i= 0; i<sk_X509_OBJECT_num(roots); i++)
 302   {
 303   X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
 304   if(tmp_obj->type == X509_LU_X509)
 305     {
 306     X509 * current_cert= tmp_obj->data.x509;
 307     X509_NAME_oneline(X509_get_subject_name(current_cert), CS name, sizeof(name));
 308         name[sizeof(name)-1] = '\0';
 309     debug_printf(" %s\n", name);
 310     }
 311   }
 312 }
 313 #endif
 314 */
 315
 316
 317 #ifndef DISABLE_EVENT
 318 static int
 319 verify_event(tls_support * tlsp, X509 * cert, int depth, const uschar * dn,
 320   BOOL *calledp, const BOOL *optionalp, const uschar * what)
 321 {
 322 uschar * ev;
 323 uschar * yield;
 324 X509 * old_cert;
 325
 326 ev = tlsp == &tls_out ? client_static_cbinfo->event_action : event_action;
 327 if (ev)
 328   {
 329   DEBUG(D_tls) debug_printf("verify_event: %s %d\n", what, depth);
 330   old_cert = tlsp->peercert;
 331   tlsp->peercert = X509_dup(cert);
 332   /* NB we do not bother setting peerdn */
 333   if ((yield = event_raise(ev, US"tls:cert", string_sprintf("%d", depth))))
 334     {
 335     log_write(0, LOG_MAIN, "[%s] %s verify denied by event-action: "
 336                 "depth=%d cert=%s: %s",
 337               tlsp == &tls_out ? deliver_host_address : sender_host_address,
 338               what, depth, dn, yield);
 339     *calledp = TRUE;
 340     if (!*optionalp)
 341       {
 342       if (old_cert) tlsp->peercert = old_cert;  /* restore 1st failing cert */
 343       return 1;                     /* reject (leaving peercert set) */
 344       }
 345     DEBUG(D_tls) debug_printf("Event-action verify failure overridden "
 346       "(host in tls_try_verify_hosts)\n");
 347     }
 348   X509_free(tlsp->peercert);
 349   tlsp->peercert = old_cert;
 350   }
 351 return 0;
 352 }
 353 #endif
 354
 355 /*************************************************
 356 *        Callback for verification               *
 357 *************************************************/
 358
 359 /* The SSL library does certificate verification if set up to do so. This
 360 callback has the current yes/no state is in "state". If verification succeeded,
 361 we set the certificate-verified flag. If verification failed, what happens
 362 depends on whether the client is required to present a verifiable certificate
 363 or not.
 364
 365 If verification is optional, we change the state to yes, but still log the
 366 verification error. For some reason (it really would help to have proper
 367 documentation of OpenSSL), this callback function then gets called again, this
 368 time with state = 1.  We must take care not to set the private verified flag on
 369 the second time through.
 370
 371 Note: this function is not called if the client fails to present a certificate
 372 when asked. We get here only if a certificate has been received. Handling of
 373 optional verification for this case is done when requesting SSL to verify, by
 374 setting SSL_VERIFY_FAIL_IF_NO_PEER_CERT in the non-optional case.
 375
 376 May be called multiple times for different issues with a certificate, even
 377 for a given "depth" in the certificate chain.
 378
 379 Arguments:
 380   preverify_ok current yes/no state as 1/0
 381   x509ctx      certificate information.
 382   tlsp         per-direction (client vs. server) support data
 383   calledp      has-been-called flag
 384   optionalp    verification-is-optional flag
 385
 386 Returns:     0 if verification should fail, otherwise 1
 387 */
 388
 389 static int
 390 verify_callback(int preverify_ok, X509_STORE_CTX *x509ctx,
 391   tls_support *tlsp, BOOL *calledp, BOOL *optionalp)
 392 {
 393 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
 394 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
 395 uschar dn[256];
 396
 397 X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn));
 398 dn[sizeof(dn)-1] = '\0';
 399
 400 if (preverify_ok == 0)
 401   {
 402   log_write(0, LOG_MAIN, "[%s] SSL verify error: depth=%d error=%s cert=%s",
 403         tlsp == &tls_out ? deliver_host_address : sender_host_address,
 404     depth,
 405     X509_verify_cert_error_string(X509_STORE_CTX_get_error(x509ctx)),
 406     dn);
 407   *calledp = TRUE;
 408   if (!*optionalp)
 409     {
 410     if (!tlsp->peercert)
 411       tlsp->peercert = X509_dup(cert);  /* record failing cert */
 412     return 0;                           /* reject */
 413     }
 414   DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
 415     "tls_try_verify_hosts)\n");
 416   }
 417
 418 else if (depth != 0)
 419   {
 420   DEBUG(D_tls) debug_printf("SSL verify ok: depth=%d SN=%s\n", depth, dn);
 421 #ifndef DISABLE_OCSP
 422   if (tlsp == &tls_out && client_static_cbinfo->u_ocsp.client.verify_store)
 423     {   /* client, wanting stapling  */
 424     /* Add the server cert's signing chain as the one
 425     for the verification of the OCSP stapled information. */
 426
 427     if (!X509_STORE_add_cert(client_static_cbinfo->u_ocsp.client.verify_store,
 428                              cert))
 429       ERR_clear_error();
 430     sk_X509_push(client_static_cbinfo->u_ocsp.client.verify_stack, cert);
 431     }
 432 #endif
 433 #ifndef DISABLE_EVENT
 434     if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
 435       return 0;                         /* reject, with peercert set */
 436 #endif
 437   }
 438 else
 439   {
 440   const uschar * verify_cert_hostnames;
 441
 442   if (  tlsp == &tls_out
 443      && ((verify_cert_hostnames = client_static_cbinfo->verify_cert_hostnames)))
 444         /* client, wanting hostname check */
 445     {
 446
 447 #ifdef EXIM_HAVE_OPENSSL_CHECKHOST
 448 # ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
 449 #  define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
 450 # endif
 451 # ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
 452 #  define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
 453 # endif
 454     int sep = 0;
 455     const uschar * list = verify_cert_hostnames;
 456     uschar * name;
 457     int rc;
 458     while ((name = string_nextinlist(&list, &sep, NULL, 0)))
 459       if ((rc = X509_check_host(cert, CCS name, 0,
 460                   X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
 461                   | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS,
 462                   NULL)))
 463         {
 464         if (rc < 0)
 465           {
 466           log_write(0, LOG_MAIN, "[%s] SSL verify error: internal error",
 467                 tlsp == &tls_out ? deliver_host_address : sender_host_address);
 468           name = NULL;
 469           }
 470         break;
 471         }
 472     if (!name)
 473 #else
 474     if (!tls_is_name_for_cert(verify_cert_hostnames, cert))
 475 #endif
 476       {
 477       log_write(0, LOG_MAIN,
 478                 "[%s] SSL verify error: certificate name mismatch: \"%s\"",
 479                 tlsp == &tls_out ? deliver_host_address : sender_host_address,
 480                 dn);
 481       *calledp = TRUE;
 482       if (!*optionalp)
 483         {
 484         if (!tlsp->peercert)
 485           tlsp->peercert = X509_dup(cert);      /* record failing cert */
 486         return 0;                               /* reject */
 487         }
 488       DEBUG(D_tls) debug_printf("SSL verify failure overridden (host in "
 489         "tls_try_verify_hosts)\n");
 490       }
 491     }
 492
 493 #ifndef DISABLE_EVENT
 494   if (verify_event(tlsp, cert, depth, dn, calledp, optionalp, US"SSL"))
 495     return 0;                           /* reject, with peercert set */
 496 #endif
 497
 498   DEBUG(D_tls) debug_printf("SSL%s verify ok: depth=0 SN=%s\n",
 499     *calledp ? "" : " authenticated", dn);
 500   if (!*calledp) tlsp->certificate_verified = TRUE;
 501   *calledp = TRUE;
 502   }
 503
 504 return 1;   /* accept, at least for this level */
 505 }
 506
 507 static int
 508 verify_callback_client(int preverify_ok, X509_STORE_CTX *x509ctx)
 509 {
 510 return verify_callback(preverify_ok, x509ctx, &tls_out,
 511   &client_verify_callback_called, &client_verify_optional);
 512 }
 513
 514 static int
 515 verify_callback_server(int preverify_ok, X509_STORE_CTX *x509ctx)
 516 {
 517 return verify_callback(preverify_ok, x509ctx, &tls_in,
 518   &server_verify_callback_called, &server_verify_optional);
 519 }
 520
 521
 522 #ifdef EXPERIMENTAL_DANE
 523
 524 /* This gets called *by* the dane library verify callback, which interposes
 525 itself.
 526 */
 527 static int
 528 verify_callback_client_dane(int preverify_ok, X509_STORE_CTX * x509ctx)
 529 {
 530 X509 * cert = X509_STORE_CTX_get_current_cert(x509ctx);
 531 uschar dn[256];
 532 #ifndef DISABLE_EVENT
 533 int depth = X509_STORE_CTX_get_error_depth(x509ctx);
 534 BOOL dummy_called, optional = FALSE;
 535 #endif
 536
 537 X509_NAME_oneline(X509_get_subject_name(cert), CS dn, sizeof(dn));
 538 dn[sizeof(dn)-1] = '\0';
 539
 540 DEBUG(D_tls) debug_printf("verify_callback_client_dane: %s depth %d %s\n",
 541   preverify_ok ? "ok":"BAD", depth, dn);
 542
 543 #ifndef DISABLE_EVENT
 544   if (verify_event(&tls_out, cert, depth, dn,
 545           &dummy_called, &optional, US"DANE"))
 546     return 0;                           /* reject, with peercert set */
 547 #endif
 548
 549 if (preverify_ok == 1)
 550   tls_out.dane_verified =
 551   tls_out.certificate_verified = TRUE;
 552 else
 553   {
 554   int err = X509_STORE_CTX_get_error(x509ctx);
 555   DEBUG(D_tls)
 556     debug_printf(" - err %d '%s'\n", err, X509_verify_cert_error_string(err));
 557   if (err == X509_V_ERR_APPLICATION_VERIFICATION)
 558     preverify_ok = 1;
 559   }
 560 return preverify_ok;
 561 }
 562
 563 #endif  /*EXPERIMENTAL_DANE*/
 564
 565
 566 /*************************************************
 567 *           Information callback                 *
 568 *************************************************/
 569
 570 /* The SSL library functions call this from time to time to indicate what they
 571 are doing. We copy the string to the debugging output when TLS debugging has
 572 been requested.
 573
 574 Arguments:
 575   s         the SSL connection
 576   where
 577   ret
 578
 579 Returns:    nothing
 580 */
 581
 582 static void
 583 info_callback(SSL *s, int where, int ret)
 584 {
 585 where = where;
 586 ret = ret;
 587 DEBUG(D_tls) debug_printf("SSL info: %s\n", SSL_state_string_long(s));
 588 }
 589
 590
 591
 592 /*************************************************
 593 *                Initialize for DH               *
 594 *************************************************/
 595
 596 /* If dhparam is set, expand it, and load up the parameters for DH encryption.
 597
 598 Arguments:
 599   sctx      The current SSL CTX (inbound or outbound)
 600   dhparam   DH parameter file or fixed parameter identity string
 601   host      connected host, if client; NULL if server
 602
 603 Returns:    TRUE if OK (nothing to set up, or setup worked)
 604 */
 605
 606 static BOOL
 607 init_dh(SSL_CTX *sctx, uschar *dhparam, const host_item *host)
 608 {
 609 BIO *bio;
 610 DH *dh;
 611 uschar *dhexpanded;
 612 const char *pem;
 613
 614 if (!expand_check(dhparam, US"tls_dhparam", &dhexpanded))
 615   return FALSE;
 616
 617 if (!dhexpanded || !*dhexpanded)
 618   bio = BIO_new_mem_buf(CS std_dh_prime_default(), -1);
 619 else if (dhexpanded[0] == '/')
 620   {
 621   if (!(bio = BIO_new_file(CS dhexpanded, "r")))
 622     {
 623     tls_error(string_sprintf("could not read dhparams file %s", dhexpanded),
 624           host, US strerror(errno));
 625     return FALSE;
 626     }
 627   }
 628 else
 629   {
 630   if (Ustrcmp(dhexpanded, "none") == 0)
 631     {
 632     DEBUG(D_tls) debug_printf("Requested no DH parameters.\n");
 633     return TRUE;
 634     }
 635
 636   if (!(pem = std_dh_prime_named(dhexpanded)))
 637     {
 638     tls_error(string_sprintf("Unknown standard DH prime \"%s\"", dhexpanded),
 639         host, US strerror(errno));
 640     return FALSE;
 641     }
 642   bio = BIO_new_mem_buf(CS pem, -1);
 643   }
 644
 645 if (!(dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL)))
 646   {
 647   BIO_free(bio);
 648   tls_error(string_sprintf("Could not read tls_dhparams \"%s\"", dhexpanded),
 649       host, NULL);
 650   return FALSE;
 651   }
 652
 653 /* Even if it is larger, we silently return success rather than cause things
 654  * to fail out, so that a too-large DH will not knock out all TLS; it's a
 655  * debatable choice. */
 656 if ((8*DH_size(dh)) > tls_dh_max_bits)
 657   {
 658   DEBUG(D_tls)
 659     debug_printf("dhparams file %d bits, is > tls_dh_max_bits limit of %d",
 660         8*DH_size(dh), tls_dh_max_bits);
 661   }
 662 else
 663   {
 664   SSL_CTX_set_tmp_dh(sctx, dh);
 665   DEBUG(D_tls)
 666     debug_printf("Diffie-Hellman initialized from %s with %d-bit prime\n",
 667       dhexpanded ? dhexpanded : US"default", 8*DH_size(dh));
 668   }
 669
 670 DH_free(dh);
 671 BIO_free(bio);
 672
 673 return TRUE;
 674 }
 675
 676
 677
 678
 679 /*************************************************
 680 *               Initialize for ECDH              *
 681 *************************************************/
 682
 683 /* Load parameters for ECDH encryption.
 684
 685 For now, we stick to NIST P-256 because: it's simple and easy to configure;
 686 it avoids any patent issues that might bite redistributors; despite events in
 687 the news and concerns over curve choices, we're not cryptographers, we're not
 688 pretending to be, and this is "good enough" to be better than no support,
 689 protecting against most adversaries.  Given another year or two, there might
 690 be sufficient clarity about a "right" way forward to let us make an informed
 691 decision, instead of a knee-jerk reaction.
 692
 693 Longer-term, we should look at supporting both various named curves and
 694 external files generated with "openssl ecparam", much as we do for init_dh().
 695 We should also support "none" as a value, to explicitly avoid initialisation.
 696
 697 Patches welcome.
 698
 699 Arguments:
 700   sctx      The current SSL CTX (inbound or outbound)
 701   host      connected host, if client; NULL if server
 702
 703 Returns:    TRUE if OK (nothing to set up, or setup worked)
 704 */
 705
 706 static BOOL
 707 init_ecdh(SSL_CTX * sctx, host_item * host)
 708 {
 709 #ifdef OPENSSL_NO_ECDH
 710 return TRUE;
 711 #else
 712
 713 EC_KEY * ecdh;
 714 uschar * exp_curve;
 715 int nid;
 716 BOOL rv;
 717
 718 if (host)       /* No ECDH setup for clients, only for servers */
 719   return TRUE;
 720
 721 # ifndef EXIM_HAVE_ECDH
 722 DEBUG(D_tls)
 723   debug_printf("No OpenSSL API to define ECDH parameters, skipping\n");
 724 return TRUE;
 725 # else
 726
 727 if (!expand_check(tls_eccurve, US"tls_eccurve", &exp_curve))
 728   return FALSE;
 729 if (!exp_curve || !*exp_curve)
 730   return TRUE;
 731
 732 #  ifdef EXIM_HAVE_OPENSSL_ECDH_AUTO
 733 /* check if new enough library to support auto ECDH temp key parameter selection */
 734 if (Ustrcmp(exp_curve, "auto") == 0)
 735   {
 736   DEBUG(D_tls) debug_printf(
 737     "ECDH temp key parameter settings: OpenSSL 1.2+ autoselection\n");
 738   SSL_CTX_set_ecdh_auto(sctx, 1);
 739   return TRUE;
 740   }
 741 #  endif
 742
 743 DEBUG(D_tls) debug_printf("ECDH: curve '%s'\n", exp_curve);
 744 if (  (nid = OBJ_sn2nid       (CCS exp_curve)) == NID_undef
 745 #   ifdef EXIM_HAVE_OPENSSL_EC_NIST2NID
 746    && (nid = EC_curve_nist2nid(CCS exp_curve)) == NID_undef
 747 #   endif
 748    )
 749   {
 750   tls_error(string_sprintf("Unknown curve name tls_eccurve '%s'",
 751       exp_curve),
 752     host, NULL);
 753   return FALSE;
 754   }
 755
 756 if (!(ecdh = EC_KEY_new_by_curve_name(nid)))
 757   {
 758   tls_error(US"Unable to create ec curve", host, NULL);
 759   return FALSE;
 760   }
 761
 762 /* The "tmp" in the name here refers to setting a temporary key
 763 not to the stability of the interface. */
 764
 765 if ((rv = SSL_CTX_set_tmp_ecdh(sctx, ecdh) == 0))
 766   tls_error(string_sprintf("Error enabling '%s' curve", exp_curve), host, NULL);
 767 else
 768   DEBUG(D_tls) debug_printf("ECDH: enabled '%s' curve\n", exp_curve);
 769
 770 EC_KEY_free(ecdh);
 771 return !rv;
 772
 773 # endif /*EXIM_HAVE_ECDH*/
 774 #endif /*OPENSSL_NO_ECDH*/
 775 }
 776
 777
 778
 779
 780 #ifndef DISABLE_OCSP
 781 /*************************************************
 782 *       Load OCSP information into state         *
 783 *************************************************/
 784
 785 static STACK_OF(X509) *
 786 cert_stack_from_store(X509_STORE * store)
 787 {
 788 STACK_OF(X509_OBJECT) * roots= store->objs;
 789 STACK_OF(X509) * sk = sk_X509_new_null();
 790 int i;
 791
 792 for(i = sk_X509_OBJECT_num(roots) - 1; i >= 0; i--)
 793   {
 794   X509_OBJECT * tmp_obj= sk_X509_OBJECT_value(roots, i);
 795   if(tmp_obj->type == X509_LU_X509)
 796     {
 797     X509 * x = tmp_obj->data.x509;
 798     sk_X509_push(sk, x);
 799     }
 800   }
 801 return sk;
 802 }
 803
 804 static void
 805 cert_stack_free(STACK_OF(X509) * sk)
 806 {
 807 while (sk_X509_num(sk) > 0) (void) sk_X509_pop(sk);
 808 sk_X509_free(sk);
 809 }
 810
 811
 812
 813 /* Called to load the server OCSP response from the given file into memory, once
 814 caller has determined this is needed.  Checks validity.  Debugs a message
 815 if invalid.
 816
 817 ASSUMES: single response, for single cert.
 818
 819 Arguments:
 820   sctx            the SSL_CTX* to update
 821   cbinfo          various parts of session state
 822   expanded        the filename putatively holding an OCSP response
 823
 824 */
 825
 826 static void
 827 ocsp_load_response(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo, const uschar *expanded)
 828 {
 829 BIO * bio;
 830 OCSP_RESPONSE * resp;
 831 OCSP_BASICRESP * basic_response;
 832 OCSP_SINGLERESP * single_response;
 833 ASN1_GENERALIZEDTIME * rev, * thisupd, * nextupd;
 834 X509_STORE * store;
 835 STACK_OF(X509) * sk;
 836 unsigned long verify_flags;
 837 int status, reason, i;
 838
 839 cbinfo->u_ocsp.server.file_expanded = string_copy(expanded);
 840 if (cbinfo->u_ocsp.server.response)
 841   {
 842   OCSP_RESPONSE_free(cbinfo->u_ocsp.server.response);
 843   cbinfo->u_ocsp.server.response = NULL;
 844   }
 845
 846 if (!(bio = BIO_new_file(CS cbinfo->u_ocsp.server.file_expanded, "rb")))
 847   {
 848   DEBUG(D_tls) debug_printf("Failed to open OCSP response file \"%s\"\n",
 849       cbinfo->u_ocsp.server.file_expanded);
 850   return;
 851   }
 852
 853 resp = d2i_OCSP_RESPONSE_bio(bio, NULL);
 854 BIO_free(bio);
 855 if (!resp)
 856   {
 857   DEBUG(D_tls) debug_printf("Error reading OCSP response.\n");
 858   return;
 859   }
 860
 861 if ((status = OCSP_response_status(resp)) != OCSP_RESPONSE_STATUS_SUCCESSFUL)
 862   {
 863   DEBUG(D_tls) debug_printf("OCSP response not valid: %s (%d)\n",
 864       OCSP_response_status_str(status), status);
 865   goto bad;
 866   }
 867
 868 if (!(basic_response = OCSP_response_get1_basic(resp)))
 869   {
 870   DEBUG(D_tls)
 871     debug_printf("OCSP response parse error: unable to extract basic response.\n");
 872   goto bad;
 873   }
 874
 875 store = SSL_CTX_get_cert_store(sctx);
 876 sk = cert_stack_from_store(store);
 877 verify_flags = OCSP_NOVERIFY; /* check sigs, but not purpose */
 878
 879 /* May need to expose ability to adjust those flags?
 880 OCSP_NOSIGS OCSP_NOVERIFY OCSP_NOCHAIN OCSP_NOCHECKS OCSP_NOEXPLICIT
 881 OCSP_TRUSTOTHER OCSP_NOINTERN */
 882
 883 /* This does a full verify on the OCSP proof before we load it for serviing
 884 up; possibly overkill - just date-checks might be nice enough.
 885
 886 OCSP_basic_verify takes a "store" arg, but does not
 887 use it for the chain verification, which is all we do
 888 when OCSP_NOVERIFY is set.  The content from the wire
 889 "basic_response" and a cert-stack "sk" are all that is used.
 890
 891 Seperately we might try to replace using OCSP_basic_verify() - which seems to not
 892 be a public interface into the OpenSSL library (there's no manual entry) -
 893 But what with?  We also use OCSP_basic_verify in the client stapling callback.
 894 And there we NEED it; we miust verify that status... unless the
 895 library does it for us anyway?  */
 896
 897 if ((i = OCSP_basic_verify(basic_response, sk, NULL, verify_flags)) < 0)
 898   {
 899   DEBUG(D_tls)
 900     {
 901     ERR_error_string(ERR_get_error(), ssl_errstring);
 902     debug_printf("OCSP response verify failure: %s\n", US ssl_errstring);
 903     }
 904   cert_stack_free(sk);
 905   goto bad;
 906   }
 907 cert_stack_free(sk);
 908
 909 /* Here's the simplifying assumption: there's only one response, for the
 910 one certificate we use, and nothing for anything else in a chain.  If this
 911 proves false, we need to extract a cert id from our issued cert
 912 (tls_certificate) and use that for OCSP_resp_find_status() (which finds the
 913 right cert in the stack and then calls OCSP_single_get0_status()).
 914
 915 I'm hoping to avoid reworking a bunch more of how we handle state here. */
 916
 917 if (!(single_response = OCSP_resp_get0(basic_response, 0)))
 918   {
 919   DEBUG(D_tls)
 920     debug_printf("Unable to get first response from OCSP basic response.\n");
 921   goto bad;
 922   }
 923
 924 status = OCSP_single_get0_status(single_response, &reason, &rev, &thisupd, &nextupd);
 925 if (status != V_OCSP_CERTSTATUS_GOOD)
 926   {
 927   DEBUG(D_tls) debug_printf("OCSP response bad cert status: %s (%d) %s (%d)\n",
 928       OCSP_cert_status_str(status), status,
 929       OCSP_crl_reason_str(reason), reason);
 930   goto bad;
 931   }
 932
 933 if (!OCSP_check_validity(thisupd, nextupd, EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
 934   {
 935   DEBUG(D_tls) debug_printf("OCSP status invalid times.\n");
 936   goto bad;
 937   }
 938
 939 supply_response:
 940   cbinfo->u_ocsp.server.response = resp;
 941 return;
 942
 943 bad:
 944   if (running_in_test_harness)
 945     {
 946     extern char ** environ;
 947     uschar ** p;
 948     if (environ) for (p = USS environ; *p != NULL; p++)
 949       if (Ustrncmp(*p, "EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK", 42) == 0)
 950         {
 951         DEBUG(D_tls) debug_printf("Supplying known bad OCSP response\n");
 952         goto supply_response;
 953         }
 954     }
 955 return;
 956 }
 957 #endif  /*!DISABLE_OCSP*/
 958
 959
 960
 961
 962 /* Create and install a selfsigned certificate, for use in server mode */
 963
 964 static int
 965 tls_install_selfsign(SSL_CTX * sctx)
 966 {
 967 X509 * x509 = NULL;
 968 EVP_PKEY * pkey;
 969 RSA * rsa;
 970 X509_NAME * name;
 971 uschar * where;
 972
 973 where = US"allocating pkey";
 974 if (!(pkey = EVP_PKEY_new()))
 975   goto err;
 976
 977 where = US"allocating cert";
 978 if (!(x509 = X509_new()))
 979   goto err;
 980
 981 where = US"generating pkey";
 982                 /* deprecated, use RSA_generate_key_ex() */
 983 if (!(rsa = RSA_generate_key(1024, RSA_F4, NULL, NULL)))
 984   goto err;
 985
 986 where = US"assiging pkey";
 987 if (!EVP_PKEY_assign_RSA(pkey, rsa))
 988   goto err;
 989
 990 X509_set_version(x509, 2);                              /* N+1 - version 3 */
 991 ASN1_INTEGER_set(X509_get_serialNumber(x509), 0);
 992 X509_gmtime_adj(X509_get_notBefore(x509), 0);
 993 X509_gmtime_adj(X509_get_notAfter(x509), (long)60 * 60);        /* 1 hour */
 994 X509_set_pubkey(x509, pkey);
 995
 996 name = X509_get_subject_name(x509);
 997 X509_NAME_add_entry_by_txt(name, "C",
 998                           MBSTRING_ASC, CUS "UK", -1, -1, 0);
 999 X509_NAME_add_entry_by_txt(name, "O",
1000                           MBSTRING_ASC, CUS "Exim Developers", -1, -1, 0);
1001 X509_NAME_add_entry_by_txt(name, "CN",
1002                           MBSTRING_ASC, CUS smtp_active_hostname, -1, -1, 0);
1003 X509_set_issuer_name(x509, name);
1004
1005 where = US"signing cert";
1006 if (!X509_sign(x509, pkey, EVP_md5()))
1007   goto err;
1008
1009 where = US"installing selfsign cert";
1010 if (!SSL_CTX_use_certificate(sctx, x509))
1011   goto err;
1012
1013 where = US"installing selfsign key";
1014 if (!SSL_CTX_use_PrivateKey(sctx, pkey))
1015   goto err;
1016
1017 return OK;
1018
1019 err:
1020   (void) tls_error(where, NULL, NULL);
1021   if (x509) X509_free(x509);
1022   if (pkey) EVP_PKEY_free(pkey);
1023   return DEFER;
1024 }
1025
1026
1027
1028
1029 /*************************************************
1030 *        Expand key and cert file specs          *
1031 *************************************************/
1032
1033 /* Called once during tls_init and possibly again during TLS setup, for a
1034 new context, if Server Name Indication was used and tls_sni was seen in
1035 the certificate string.
1036
1037 Arguments:
1038   sctx            the SSL_CTX* to update
1039   cbinfo          various parts of session state
1040
1041 Returns:          OK/DEFER/FAIL
1042 */
1043
1044 static int
1045 tls_expand_session_files(SSL_CTX *sctx, tls_ext_ctx_cb *cbinfo)
1046 {
1047 uschar *expanded;
1048
1049 if (!cbinfo->certificate)
1050   {
1051   if (cbinfo->host)                     /* client */
1052     return OK;
1053                                         /* server */
1054   if (tls_install_selfsign(sctx) != OK)
1055     return DEFER;
1056   }
1057 else
1058   {
1059   if (Ustrstr(cbinfo->certificate, US"tls_sni") ||
1060       Ustrstr(cbinfo->certificate, US"tls_in_sni") ||
1061       Ustrstr(cbinfo->certificate, US"tls_out_sni")
1062      )
1063     reexpand_tls_files_for_sni = TRUE;
1064
1065   if (!expand_check(cbinfo->certificate, US"tls_certificate", &expanded))
1066     return DEFER;
1067
1068   if (expanded != NULL)
1069     {
1070     DEBUG(D_tls) debug_printf("tls_certificate file %s\n", expanded);
1071     if (!SSL_CTX_use_certificate_chain_file(sctx, CS expanded))
1072       return tls_error(string_sprintf(
1073         "SSL_CTX_use_certificate_chain_file file=%s", expanded),
1074           cbinfo->host, NULL);
1075     }
1076
1077   if (cbinfo->privatekey != NULL &&
1078       !expand_check(cbinfo->privatekey, US"tls_privatekey", &expanded))
1079     return DEFER;
1080
1081   /* If expansion was forced to fail, key_expanded will be NULL. If the result
1082   of the expansion is an empty string, ignore it also, and assume the private
1083   key is in the same file as the certificate. */
1084
1085   if (expanded && *expanded)
1086     {
1087     DEBUG(D_tls) debug_printf("tls_privatekey file %s\n", expanded);
1088     if (!SSL_CTX_use_PrivateKey_file(sctx, CS expanded, SSL_FILETYPE_PEM))
1089       return tls_error(string_sprintf(
1090         "SSL_CTX_use_PrivateKey_file file=%s", expanded), cbinfo->host, NULL);
1091     }
1092   }
1093
1094 #ifndef DISABLE_OCSP
1095 if (cbinfo->is_server && cbinfo->u_ocsp.server.file)
1096   {
1097   if (!expand_check(cbinfo->u_ocsp.server.file, US"tls_ocsp_file", &expanded))
1098     return DEFER;
1099
1100   if (expanded && *expanded)
1101     {
1102     DEBUG(D_tls) debug_printf("tls_ocsp_file %s\n", expanded);
1103     if (  cbinfo->u_ocsp.server.file_expanded
1104        && (Ustrcmp(expanded, cbinfo->u_ocsp.server.file_expanded) == 0))
1105       {
1106       DEBUG(D_tls) debug_printf(" - value unchanged, using existing values\n");
1107       }
1108     else
1109       {
1110       ocsp_load_response(sctx, cbinfo, expanded);
1111       }
1112     }
1113   }
1114 #endif
1115
1116 return OK;
1117 }
1118
1119
1120
1121
1122 /*************************************************
1123 *            Callback to handle SNI              *
1124 *************************************************/
1125
1126 /* Called when acting as server during the TLS session setup if a Server Name
1127 Indication extension was sent by the client.
1128
1129 API documentation is OpenSSL s_server.c implementation.
1130
1131 Arguments:
1132   s               SSL* of the current session
1133   ad              unknown (part of OpenSSL API) (unused)
1134   arg             Callback of "our" registered data
1135
1136 Returns:          SSL_TLSEXT_ERR_{OK,ALERT_WARNING,ALERT_FATAL,NOACK}
1137 */
1138
1139 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
1140 static int
1141 tls_servername_cb(SSL *s, int *ad ARG_UNUSED, void *arg)
1142 {
1143 const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
1144 tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
1145 int rc;
1146 int old_pool = store_pool;
1147
1148 if (!servername)
1149   return SSL_TLSEXT_ERR_OK;
1150
1151 DEBUG(D_tls) debug_printf("Received TLS SNI \"%s\"%s\n", servername,
1152     reexpand_tls_files_for_sni ? "" : " (unused for certificate selection)");
1153
1154 /* Make the extension value available for expansion */
1155 store_pool = POOL_PERM;
1156 tls_in.sni = string_copy(US servername);
1157 store_pool = old_pool;
1158
1159 if (!reexpand_tls_files_for_sni)
1160   return SSL_TLSEXT_ERR_OK;
1161
1162 /* Can't find an SSL_CTX_clone() or equivalent, so we do it manually;
1163 not confident that memcpy wouldn't break some internal reference counting.
1164 Especially since there's a references struct member, which would be off. */
1165
1166 if (!(server_sni = SSL_CTX_new(SSLv23_server_method())))
1167   {
1168   ERR_error_string(ERR_get_error(), ssl_errstring);
1169   DEBUG(D_tls) debug_printf("SSL_CTX_new() failed: %s\n", ssl_errstring);
1170   return SSL_TLSEXT_ERR_NOACK;
1171   }
1172
1173 /* Not sure how many of these are actually needed, since SSL object
1174 already exists.  Might even need this selfsame callback, for reneg? */
1175
1176 SSL_CTX_set_info_callback(server_sni, SSL_CTX_get_info_callback(server_ctx));
1177 SSL_CTX_set_mode(server_sni, SSL_CTX_get_mode(server_ctx));
1178 SSL_CTX_set_options(server_sni, SSL_CTX_get_options(server_ctx));
1179 SSL_CTX_set_timeout(server_sni, SSL_CTX_get_timeout(server_ctx));
1180 SSL_CTX_set_tlsext_servername_callback(server_sni, tls_servername_cb);
1181 SSL_CTX_set_tlsext_servername_arg(server_sni, cbinfo);
1182
1183 if (  !init_dh(server_sni, cbinfo->dhparam, NULL)
1184    || !init_ecdh(server_sni, NULL)
1185    )
1186   return SSL_TLSEXT_ERR_NOACK;
1187
1188 if (cbinfo->server_cipher_list)
1189   SSL_CTX_set_cipher_list(server_sni, CS cbinfo->server_cipher_list);
1190 #ifndef DISABLE_OCSP
1191 if (cbinfo->u_ocsp.server.file)
1192   {
1193   SSL_CTX_set_tlsext_status_cb(server_sni, tls_server_stapling_cb);
1194   SSL_CTX_set_tlsext_status_arg(server_sni, cbinfo);
1195   }
1196 #endif
1197
1198 rc = setup_certs(server_sni, tls_verify_certificates, tls_crl, NULL, FALSE, verify_callback_server);
1199 if (rc != OK) return SSL_TLSEXT_ERR_NOACK;
1200
1201 /* do this after setup_certs, because this can require the certs for verifying
1202 OCSP information. */
1203 if ((rc = tls_expand_session_files(server_sni, cbinfo)) != OK)
1204   return SSL_TLSEXT_ERR_NOACK;
1205
1206 DEBUG(D_tls) debug_printf("Switching SSL context.\n");
1207 SSL_set_SSL_CTX(s, server_sni);
1208
1209 return SSL_TLSEXT_ERR_OK;
1210 }
1211 #endif /* EXIM_HAVE_OPENSSL_TLSEXT */
1212
1213
1214
1215
1216 #ifndef DISABLE_OCSP
1217
1218 /*************************************************
1219 *        Callback to handle OCSP Stapling        *
1220 *************************************************/
1221
1222 /* Called when acting as server during the TLS session setup if the client
1223 requests OCSP information with a Certificate Status Request.
1224
1225 Documentation via openssl s_server.c and the Apache patch from the OpenSSL
1226 project.
1227
1228 */
1229
1230 static int
1231 tls_server_stapling_cb(SSL *s, void *arg)
1232 {
1233 const tls_ext_ctx_cb *cbinfo = (tls_ext_ctx_cb *) arg;
1234 uschar *response_der;
1235 int response_der_len;
1236
1237 DEBUG(D_tls)
1238   debug_printf("Received TLS status request (OCSP stapling); %s response\n",
1239     cbinfo->u_ocsp.server.response ? "have" : "lack");
1240
1241 tls_in.ocsp = OCSP_NOT_RESP;
1242 if (!cbinfo->u_ocsp.server.response)
1243   return SSL_TLSEXT_ERR_NOACK;
1244
1245 response_der = NULL;
1246 response_der_len = i2d_OCSP_RESPONSE(cbinfo->u_ocsp.server.response,
1247                       &response_der);
1248 if (response_der_len <= 0)
1249   return SSL_TLSEXT_ERR_NOACK;
1250
1251 SSL_set_tlsext_status_ocsp_resp(server_ssl, response_der, response_der_len);
1252 tls_in.ocsp = OCSP_VFIED;
1253 return SSL_TLSEXT_ERR_OK;
1254 }
1255
1256
1257 static void
1258 time_print(BIO * bp, const char * str, ASN1_GENERALIZEDTIME * time)
1259 {
1260 BIO_printf(bp, "\t%s: ", str);
1261 ASN1_GENERALIZEDTIME_print(bp, time);
1262 BIO_puts(bp, "\n");
1263 }
1264
1265 static int
1266 tls_client_stapling_cb(SSL *s, void *arg)
1267 {
1268 tls_ext_ctx_cb * cbinfo = arg;
1269 const unsigned char * p;
1270 int len;
1271 OCSP_RESPONSE * rsp;
1272 OCSP_BASICRESP * bs;
1273 int i;
1274
1275 DEBUG(D_tls) debug_printf("Received TLS status response (OCSP stapling):");
1276 len = SSL_get_tlsext_status_ocsp_resp(s, &p);
1277 if(!p)
1278  {
1279   /* Expect this when we requested ocsp but got none */
1280   if (cbinfo->u_ocsp.client.verify_required && LOGGING(tls_cipher))
1281     log_write(0, LOG_MAIN, "Received TLS status callback, null content");
1282   else
1283     DEBUG(D_tls) debug_printf(" null\n");
1284   return cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1285  }
1286
1287 if(!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
1288  {
1289   tls_out.ocsp = OCSP_FAILED;
1290   if (LOGGING(tls_cipher))
1291     log_write(0, LOG_MAIN, "Received TLS cert status response, parse error");
1292   else
1293     DEBUG(D_tls) debug_printf(" parse error\n");
1294   return 0;
1295  }
1296
1297 if(!(bs = OCSP_response_get1_basic(rsp)))
1298   {
1299   tls_out.ocsp = OCSP_FAILED;
1300   if (LOGGING(tls_cipher))
1301     log_write(0, LOG_MAIN, "Received TLS cert status response, error parsing response");
1302   else
1303     DEBUG(D_tls) debug_printf(" error parsing response\n");
1304   OCSP_RESPONSE_free(rsp);
1305   return 0;
1306   }
1307
1308 /* We'd check the nonce here if we'd put one in the request. */
1309 /* However that would defeat cacheability on the server so we don't. */
1310
1311 /* This section of code reworked from OpenSSL apps source;
1312    The OpenSSL Project retains copyright:
1313    Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
1314 */
1315   {
1316     BIO * bp = NULL;
1317     int status, reason;
1318     ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
1319
1320     DEBUG(D_tls) bp = BIO_new_fp(stderr, BIO_NOCLOSE);
1321
1322     /*OCSP_RESPONSE_print(bp, rsp, 0);   extreme debug: stapling content */
1323
1324     /* Use the chain that verified the server cert to verify the stapled info */
1325     /* DEBUG(D_tls) x509_store_dump_cert_s_names(cbinfo->u_ocsp.client.verify_store); */
1326
1327     if ((i = OCSP_basic_verify(bs, cbinfo->u_ocsp.client.verify_stack,
1328               cbinfo->u_ocsp.client.verify_store, 0)) <= 0)
1329       {
1330       tls_out.ocsp = OCSP_FAILED;
1331       if (LOGGING(tls_cipher))
1332         log_write(0, LOG_MAIN, "Received TLS cert status response, itself unverifiable");
1333       BIO_printf(bp, "OCSP response verify failure\n");
1334       ERR_print_errors(bp);
1335       goto failed;
1336       }
1337
1338     BIO_printf(bp, "OCSP response well-formed and signed OK\n");
1339
1340     /*XXX So we have a good stapled OCSP status.  How do we know
1341     it is for the cert of interest?  OpenSSL 1.1.0 has a routine
1342     OCSP_resp_find_status() which matches on a cert id, which presumably
1343     we should use. Making an id needs OCSP_cert_id_new(), which takes
1344     issuerName, issuerKey, serialNumber.  Are they all in the cert?
1345
1346     For now, carry on blindly accepting the resp. */
1347
1348       {
1349       OCSP_SINGLERESP * single;
1350
1351 #ifdef EXIM_HAVE_OCSP_RESP_COUNT
1352       if (OCSP_resp_count(bs) != 1)
1353 #else
1354       STACK_OF(OCSP_SINGLERESP) * sresp = bs->tbsResponseData->responses;
1355       if (sk_OCSP_SINGLERESP_num(sresp) != 1)
1356 #endif
1357         {
1358         tls_out.ocsp = OCSP_FAILED;
1359         log_write(0, LOG_MAIN, "OCSP stapling "
1360             "with multiple responses not handled");
1361         goto failed;
1362         }
1363       single = OCSP_resp_get0(bs, 0);
1364       status = OCSP_single_get0_status(single, &reason, &rev,
1365                   &thisupd, &nextupd);
1366       }
1367
1368     DEBUG(D_tls) time_print(bp, "This OCSP Update", thisupd);
1369     DEBUG(D_tls) if(nextupd) time_print(bp, "Next OCSP Update", nextupd);
1370     if (!OCSP_check_validity(thisupd, nextupd,
1371           EXIM_OCSP_SKEW_SECONDS, EXIM_OCSP_MAX_AGE))
1372       {
1373       tls_out.ocsp = OCSP_FAILED;
1374       DEBUG(D_tls) ERR_print_errors(bp);
1375       log_write(0, LOG_MAIN, "Server OSCP dates invalid");
1376       }
1377     else
1378       {
1379       DEBUG(D_tls) BIO_printf(bp, "Certificate status: %s\n",
1380                     OCSP_cert_status_str(status));
1381       switch(status)
1382         {
1383         case V_OCSP_CERTSTATUS_GOOD:
1384           tls_out.ocsp = OCSP_VFIED;
1385           i = 1;
1386           goto good;
1387         case V_OCSP_CERTSTATUS_REVOKED:
1388           tls_out.ocsp = OCSP_FAILED;
1389           log_write(0, LOG_MAIN, "Server certificate revoked%s%s",
1390               reason != -1 ? "; reason: " : "",
1391               reason != -1 ? OCSP_crl_reason_str(reason) : "");
1392           DEBUG(D_tls) time_print(bp, "Revocation Time", rev);
1393           break;
1394         default:
1395           tls_out.ocsp = OCSP_FAILED;
1396           log_write(0, LOG_MAIN,
1397               "Server certificate status unknown, in OCSP stapling");
1398           break;
1399         }
1400       }
1401   failed:
1402     i = cbinfo->u_ocsp.client.verify_required ? 0 : 1;
1403   good:
1404     BIO_free(bp);
1405   }
1406
1407 OCSP_RESPONSE_free(rsp);
1408 return i;
1409 }
1410 #endif  /*!DISABLE_OCSP*/
1411
1412
1413 /*************************************************
1414 *            Initialize for TLS                  *
1415 *************************************************/
1416
1417 /* Called from both server and client code, to do preliminary initialization
1418 of the library.  We allocate and return a context structure.
1419
1420 Arguments:
1421   ctxp            returned SSL context
1422   host            connected host, if client; NULL if server
1423   dhparam         DH parameter file
1424   certificate     certificate file
1425   privatekey      private key
1426   ocsp_file       file of stapling info (server); flag for require ocsp (client)
1427   addr            address if client; NULL if server (for some randomness)
1428   cbp             place to put allocated callback context
1429
1430 Returns:          OK/DEFER/FAIL
1431 */
1432
1433 static int
1434 tls_init(SSL_CTX **ctxp, host_item *host, uschar *dhparam, uschar *certificate,
1435   uschar *privatekey,
1436 #ifndef DISABLE_OCSP
1437   uschar *ocsp_file,
1438 #endif
1439   address_item *addr, tls_ext_ctx_cb ** cbp)
1440 {
1441 long init_options;
1442 int rc;
1443 BOOL okay;
1444 tls_ext_ctx_cb * cbinfo;
1445
1446 cbinfo = store_malloc(sizeof(tls_ext_ctx_cb));
1447 cbinfo->certificate = certificate;
1448 cbinfo->privatekey = privatekey;
1449 #ifndef DISABLE_OCSP
1450 if ((cbinfo->is_server = host==NULL))
1451   {
1452   cbinfo->u_ocsp.server.file = ocsp_file;
1453   cbinfo->u_ocsp.server.file_expanded = NULL;
1454   cbinfo->u_ocsp.server.response = NULL;
1455   }
1456 else
1457   {
1458   cbinfo->u_ocsp.client.verify_store = NULL;
1459   cbinfo->u_ocsp.client.verify_stack = NULL;
1460   }
1461 #endif
1462 cbinfo->dhparam = dhparam;
1463 cbinfo->server_cipher_list = NULL;
1464 cbinfo->host = host;
1465 #ifndef DISABLE_EVENT
1466 cbinfo->event_action = NULL;
1467 #endif
1468
1469 SSL_load_error_strings();          /* basic set up */
1470 OpenSSL_add_ssl_algorithms();
1471
1472 #ifdef EXIM_HAVE_SHA256
1473 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
1474 list of available digests. */
1475 EVP_add_digest(EVP_sha256());
1476 #endif
1477
1478 /* Create a context.
1479 The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
1480 negotiation in the different methods; as far as I can tell, the only
1481 *_{server,client}_method which allows negotiation is SSLv23, which exists even
1482 when OpenSSL is built without SSLv2 support.
1483 By disabling with openssl_options, we can let admins re-enable with the
1484 existing knob. */
1485
1486 *ctxp = SSL_CTX_new(host ? SSLv23_client_method() : SSLv23_server_method());
1487
1488 if (!*ctxp) return tls_error(US"SSL_CTX_new", host, NULL);
1489
1490 /* It turns out that we need to seed the random number generator this early in
1491 order to get the full complement of ciphers to work. It took me roughly a day
1492 of work to discover this by experiment.
1493
1494 On systems that have /dev/urandom, SSL may automatically seed itself from
1495 there. Otherwise, we have to make something up as best we can. Double check
1496 afterwards. */
1497
1498 if (!RAND_status())
1499   {
1500   randstuff r;
1501   gettimeofday(&r.tv, NULL);
1502   r.p = getpid();
1503
1504   RAND_seed((uschar *)(&r), sizeof(r));
1505   RAND_seed((uschar *)big_buffer, big_buffer_size);
1506   if (addr != NULL) RAND_seed((uschar *)addr, sizeof(addr));
1507
1508   if (!RAND_status())
1509     return tls_error(US"RAND_status", host,
1510       US"unable to seed random number generator");
1511   }
1512
1513 /* Set up the information callback, which outputs if debugging is at a suitable
1514 level. */
1515
1516 DEBUG(D_tls) SSL_CTX_set_info_callback(*ctxp, (void (*)())info_callback);
1517
1518 /* Automatically re-try reads/writes after renegotiation. */
1519 (void) SSL_CTX_set_mode(*ctxp, SSL_MODE_AUTO_RETRY);
1520
1521 /* Apply administrator-supplied work-arounds.
1522 Historically we applied just one requested option,
1523 SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS, but when bug 994 requested a second, we
1524 moved to an administrator-controlled list of options to specify and
1525 grandfathered in the first one as the default value for "openssl_options".
1526
1527 No OpenSSL version number checks: the options we accept depend upon the
1528 availability of the option value macros from OpenSSL.  */
1529
1530 okay = tls_openssl_options_parse(openssl_options, &init_options);
1531 if (!okay)
1532   return tls_error(US"openssl_options parsing failed", host, NULL);
1533
1534 if (init_options)
1535   {
1536   DEBUG(D_tls) debug_printf("setting SSL CTX options: %#lx\n", init_options);
1537   if (!(SSL_CTX_set_options(*ctxp, init_options)))
1538     return tls_error(string_sprintf(
1539           "SSL_CTX_set_option(%#lx)", init_options), host, NULL);
1540   }
1541 else
1542   DEBUG(D_tls) debug_printf("no SSL CTX options to set\n");
1543
1544 /* Initialize with DH parameters if supplied */
1545 /* Initialize ECDH temp key parameter selection */
1546
1547 if (  !init_dh(*ctxp, dhparam, host)
1548    || !init_ecdh(*ctxp, host)
1549    )
1550   return DEFER;
1551
1552 /* Set up certificate and key (and perhaps OCSP info) */
1553
1554 if ((rc = tls_expand_session_files(*ctxp, cbinfo)) != OK)
1555   return rc;
1556
1557 /* If we need to handle SNI, do so */
1558 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
1559 if (host == NULL)               /* server */
1560   {
1561 # ifndef DISABLE_OCSP
1562   /* We check u_ocsp.server.file, not server.response, because we care about if
1563   the option exists, not what the current expansion might be, as SNI might
1564   change the certificate and OCSP file in use between now and the time the
1565   callback is invoked. */
1566   if (cbinfo->u_ocsp.server.file)
1567     {
1568     SSL_CTX_set_tlsext_status_cb(server_ctx, tls_server_stapling_cb);
1569     SSL_CTX_set_tlsext_status_arg(server_ctx, cbinfo);
1570     }
1571 # endif
1572   /* We always do this, so that $tls_sni is available even if not used in
1573   tls_certificate */
1574   SSL_CTX_set_tlsext_servername_callback(*ctxp, tls_servername_cb);
1575   SSL_CTX_set_tlsext_servername_arg(*ctxp, cbinfo);
1576   }
1577 # ifndef DISABLE_OCSP
1578 else                    /* client */
1579   if(ocsp_file)         /* wanting stapling */
1580     {
1581     if (!(cbinfo->u_ocsp.client.verify_store = X509_STORE_new()))
1582       {
1583       DEBUG(D_tls) debug_printf("failed to create store for stapling verify\n");
1584       return FAIL;
1585       }
1586     if (!(cbinfo->u_ocsp.client.verify_stack = sk_X509_new_null()))
1587       {
1588       DEBUG(D_tls) debug_printf("failed to create stack for stapling verify\n");
1589       return FAIL;
1590       }
1591     SSL_CTX_set_tlsext_status_cb(*ctxp, tls_client_stapling_cb);
1592     SSL_CTX_set_tlsext_status_arg(*ctxp, cbinfo);
1593     }
1594 # endif
1595 #endif
1596
1597 cbinfo->verify_cert_hostnames = NULL;
1598
1599 #ifdef EXIM_HAVE_EPHEM_RSA_KEX
1600 /* Set up the RSA callback */
1601 SSL_CTX_set_tmp_rsa_callback(*ctxp, rsa_callback);
1602 #endif
1603
1604 /* Finally, set the timeout, and we are done */
1605
1606 SSL_CTX_set_timeout(*ctxp, ssl_session_timeout);
1607 DEBUG(D_tls) debug_printf("Initialized TLS\n");
1608
1609 *cbp = cbinfo;
1610
1611 return OK;
1612 }
1613
1614
1615
1616
1617 /*************************************************
1618 *           Get name of cipher in use            *
1619 *************************************************/
1620
1621 /*
1622 Argument:   pointer to an SSL structure for the connection
1623             buffer to use for answer
1624             size of buffer
1625             pointer to number of bits for cipher
1626 Returns:    nothing
1627 */
1628
1629 static void
1630 construct_cipher_name(SSL *ssl, uschar *cipherbuf, int bsize, int *bits)
1631 {
1632 /* With OpenSSL 1.0.0a, this needs to be const but the documentation doesn't
1633 yet reflect that.  It should be a safe change anyway, even 0.9.8 versions have
1634 the accessor functions use const in the prototype. */
1635 const SSL_CIPHER *c;
1636 const uschar *ver;
1637
1638 ver = (const uschar *)SSL_get_version(ssl);
1639
1640 c = (const SSL_CIPHER *) SSL_get_current_cipher(ssl);
1641 SSL_CIPHER_get_bits(c, bits);
1642
1643 string_format(cipherbuf, bsize, "%s:%s:%u", ver,
1644   SSL_CIPHER_get_name(c), *bits);
1645
1646 DEBUG(D_tls) debug_printf("Cipher: %s\n", cipherbuf);
1647 }
1648
1649
1650 static void
1651 peer_cert(SSL * ssl, tls_support * tlsp, uschar * peerdn, unsigned bsize)
1652 {
1653 /*XXX we might consider a list-of-certs variable for the cert chain.
1654 SSL_get_peer_cert_chain(SSL*).  We'd need a new variable type and support
1655 in list-handling functions, also consider the difference between the entire
1656 chain and the elements sent by the peer. */
1657
1658 /* Will have already noted peercert on a verify fail; possibly not the leaf */
1659 if (!tlsp->peercert)
1660   tlsp->peercert = SSL_get_peer_certificate(ssl);
1661 /* Beware anonymous ciphers which lead to server_cert being NULL */
1662 if (tlsp->peercert)
1663   {
1664   X509_NAME_oneline(X509_get_subject_name(tlsp->peercert), CS peerdn, bsize);
1665   peerdn[bsize-1] = '\0';
1666   tlsp->peerdn = peerdn;                /*XXX a static buffer... */
1667   }
1668 else
1669   tlsp->peerdn = NULL;
1670 }
1671
1672
1673
1674
1675
1676 /*************************************************
1677 *        Set up for verifying certificates       *
1678 *************************************************/
1679
1680 /* Called by both client and server startup
1681
1682 Arguments:
1683   sctx          SSL_CTX* to initialise
1684   certs         certs file or NULL
1685   crl           CRL file or NULL
1686   host          NULL in a server; the remote host in a client
1687   optional      TRUE if called from a server for a host in tls_try_verify_hosts;
1688                 otherwise passed as FALSE
1689   cert_vfy_cb   Callback function for certificate verification
1690
1691 Returns:        OK/DEFER/FAIL
1692 */
1693
1694 static int
1695 setup_certs(SSL_CTX *sctx, uschar *certs, uschar *crl, host_item *host, BOOL optional,
1696     int (*cert_vfy_cb)(int, X509_STORE_CTX *) )
1697 {
1698 uschar *expcerts, *expcrl;
1699
1700 if (!expand_check(certs, US"tls_verify_certificates", &expcerts))
1701   return DEFER;
1702
1703 if (expcerts && *expcerts)
1704   {
1705   /* Tell the library to use its compiled-in location for the system default
1706   CA bundle. Then add the ones specified in the config, if any. */
1707
1708   if (!SSL_CTX_set_default_verify_paths(sctx))
1709     return tls_error(US"SSL_CTX_set_default_verify_paths", host, NULL);
1710
1711   if (Ustrcmp(expcerts, "system") != 0)
1712     {
1713     struct stat statbuf;
1714
1715     if (Ustat(expcerts, &statbuf) < 0)
1716       {
1717       log_write(0, LOG_MAIN|LOG_PANIC,
1718         "failed to stat %s for certificates", expcerts);
1719       return DEFER;
1720       }
1721     else
1722       {
1723       uschar *file, *dir;
1724       if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
1725         { file = NULL; dir = expcerts; }
1726       else
1727         { file = expcerts; dir = NULL; }
1728
1729       /* If a certificate file is empty, the next function fails with an
1730       unhelpful error message. If we skip it, we get the correct behaviour (no
1731       certificates are recognized, but the error message is still misleading (it
1732       says no certificate was supplied.) But this is better. */
1733
1734       if (  (!file || statbuf.st_size > 0)
1735          && !SSL_CTX_load_verify_locations(sctx, CS file, CS dir))
1736         return tls_error(US"SSL_CTX_load_verify_locations", host, NULL);
1737
1738       /* Load the list of CAs for which we will accept certs, for sending
1739       to the client.  This is only for the one-file tls_verify_certificates
1740       variant.
1741       If a list isn't loaded into the server, but
1742       some verify locations are set, the server end appears to make
1743       a wildcard reqest for client certs.
1744       Meanwhile, the client library as default behaviour *ignores* the list
1745       we send over the wire - see man SSL_CTX_set_client_cert_cb.
1746       Because of this, and that the dir variant is likely only used for
1747       the public-CA bundle (not for a private CA), not worth fixing.
1748       */
1749       if (file)
1750         {
1751         STACK_OF(X509_NAME) * names = SSL_load_client_CA_file(CS file);
1752
1753         DEBUG(D_tls) debug_printf("Added %d certificate authorities.\n",
1754                                     sk_X509_NAME_num(names));
1755         SSL_CTX_set_client_CA_list(sctx, names);
1756         }
1757       }
1758     }
1759
1760   /* Handle a certificate revocation list. */
1761
1762 #if OPENSSL_VERSION_NUMBER > 0x00907000L
1763
1764   /* This bit of code is now the version supplied by Lars Mainka. (I have
1765   merely reformatted it into the Exim code style.)
1766
1767   "From here I changed the code to add support for multiple crl's
1768   in pem format in one file or to support hashed directory entries in
1769   pem format instead of a file. This method now uses the library function
1770   X509_STORE_load_locations to add the CRL location to the SSL context.
1771   OpenSSL will then handle the verify against CA certs and CRLs by
1772   itself in the verify callback." */
1773
1774   if (!expand_check(crl, US"tls_crl", &expcrl)) return DEFER;
1775   if (expcrl && *expcrl)
1776     {
1777     struct stat statbufcrl;
1778     if (Ustat(expcrl, &statbufcrl) < 0)
1779       {
1780       log_write(0, LOG_MAIN|LOG_PANIC,
1781         "failed to stat %s for certificates revocation lists", expcrl);
1782       return DEFER;
1783       }
1784     else
1785       {
1786       /* is it a file or directory? */
1787       uschar *file, *dir;
1788       X509_STORE *cvstore = SSL_CTX_get_cert_store(sctx);
1789       if ((statbufcrl.st_mode & S_IFMT) == S_IFDIR)
1790         {
1791         file = NULL;
1792         dir = expcrl;
1793         DEBUG(D_tls) debug_printf("SSL CRL value is a directory %s\n", dir);
1794         }
1795       else
1796         {
1797         file = expcrl;
1798         dir = NULL;
1799         DEBUG(D_tls) debug_printf("SSL CRL value is a file %s\n", file);
1800         }
1801       if (X509_STORE_load_locations(cvstore, CS file, CS dir) == 0)
1802         return tls_error(US"X509_STORE_load_locations", host, NULL);
1803
1804       /* setting the flags to check against the complete crl chain */
1805
1806       X509_STORE_set_flags(cvstore,
1807         X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL);
1808       }
1809     }
1810
1811 #endif  /* OPENSSL_VERSION_NUMBER > 0x00907000L */
1812
1813   /* If verification is optional, don't fail if no certificate */
1814
1815   SSL_CTX_set_verify(sctx,
1816     SSL_VERIFY_PEER | (optional? 0 : SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
1817     cert_vfy_cb);
1818   }
1819
1820 return OK;
1821 }
1822
1823
1824
1825 /*************************************************
1826 *       Start a TLS session in a server          *
1827 *************************************************/
1828
1829 /* This is called when Exim is running as a server, after having received
1830 the STARTTLS command. It must respond to that command, and then negotiate
1831 a TLS session.
1832
1833 Arguments:
1834   require_ciphers   allowed ciphers
1835
1836 Returns:            OK on success
1837                     DEFER for errors before the start of the negotiation
1838                     FAIL for errors during the negotation; the server can't
1839                       continue running.
1840 */
1841
1842 int
1843 tls_server_start(const uschar *require_ciphers)
1844 {
1845 int rc;
1846 uschar *expciphers;
1847 tls_ext_ctx_cb *cbinfo;
1848 static uschar peerdn[256];
1849 static uschar cipherbuf[256];
1850
1851 /* Check for previous activation */
1852
1853 if (tls_in.active >= 0)
1854   {
1855   tls_error(US"STARTTLS received after TLS started", NULL, US"");
1856   smtp_printf("554 Already in TLS\r\n");
1857   return FAIL;
1858   }
1859
1860 /* Initialize the SSL library. If it fails, it will already have logged
1861 the error. */
1862
1863 rc = tls_init(&server_ctx, NULL, tls_dhparam, tls_certificate, tls_privatekey,
1864 #ifndef DISABLE_OCSP
1865     tls_ocsp_file,
1866 #endif
1867     NULL, &server_static_cbinfo);
1868 if (rc != OK) return rc;
1869 cbinfo = server_static_cbinfo;
1870
1871 if (!expand_check(require_ciphers, US"tls_require_ciphers", &expciphers))
1872   return FAIL;
1873
1874 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
1875 were historically separated by underscores. So that I can use either form in my
1876 tests, and also for general convenience, we turn underscores into hyphens here.
1877 */
1878
1879 if (expciphers != NULL)
1880   {
1881   uschar *s = expciphers;
1882   while (*s != 0) { if (*s == '_') *s = '-'; s++; }
1883   DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
1884   if (!SSL_CTX_set_cipher_list(server_ctx, CS expciphers))
1885     return tls_error(US"SSL_CTX_set_cipher_list", NULL, NULL);
1886   cbinfo->server_cipher_list = expciphers;
1887   }
1888
1889 /* If this is a host for which certificate verification is mandatory or
1890 optional, set up appropriately. */
1891
1892 tls_in.certificate_verified = FALSE;
1893 #ifdef EXPERIMENTAL_DANE
1894 tls_in.dane_verified = FALSE;
1895 #endif
1896 server_verify_callback_called = FALSE;
1897
1898 if (verify_check_host(&tls_verify_hosts) == OK)
1899   {
1900   rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1901                         FALSE, verify_callback_server);
1902   if (rc != OK) return rc;
1903   server_verify_optional = FALSE;
1904   }
1905 else if (verify_check_host(&tls_try_verify_hosts) == OK)
1906   {
1907   rc = setup_certs(server_ctx, tls_verify_certificates, tls_crl, NULL,
1908                         TRUE, verify_callback_server);
1909   if (rc != OK) return rc;
1910   server_verify_optional = TRUE;
1911   }
1912
1913 /* Prepare for new connection */
1914
1915 if ((server_ssl = SSL_new(server_ctx)) == NULL) return tls_error(US"SSL_new", NULL, NULL);
1916
1917 /* Warning: we used to SSL_clear(ssl) here, it was removed.
1918  *
1919  * With the SSL_clear(), we get strange interoperability bugs with
1920  * OpenSSL 1.0.1b and TLS1.1/1.2.  It looks as though this may be a bug in
1921  * OpenSSL itself, as a clear should not lead to inability to follow protocols.
1922  *
1923  * The SSL_clear() call is to let an existing SSL* be reused, typically after
1924  * session shutdown.  In this case, we have a brand new object and there's no
1925  * obvious reason to immediately clear it.  I'm guessing that this was
1926  * originally added because of incomplete initialisation which the clear fixed,
1927  * in some historic release.
1928  */
1929
1930 /* Set context and tell client to go ahead, except in the case of TLS startup
1931 on connection, where outputting anything now upsets the clients and tends to
1932 make them disconnect. We need to have an explicit fflush() here, to force out
1933 the response. Other smtp_printf() calls do not need it, because in non-TLS
1934 mode, the fflush() happens when smtp_getc() is called. */
1935
1936 SSL_set_session_id_context(server_ssl, sid_ctx, Ustrlen(sid_ctx));
1937 if (!tls_in.on_connect)
1938   {
1939   smtp_printf("220 TLS go ahead\r\n");
1940   fflush(smtp_out);
1941   }
1942
1943 /* Now negotiate the TLS session. We put our own timer on it, since it seems
1944 that the OpenSSL library doesn't. */
1945
1946 SSL_set_wfd(server_ssl, fileno(smtp_out));
1947 SSL_set_rfd(server_ssl, fileno(smtp_in));
1948 SSL_set_accept_state(server_ssl);
1949
1950 DEBUG(D_tls) debug_printf("Calling SSL_accept\n");
1951
1952 sigalrm_seen = FALSE;
1953 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
1954 rc = SSL_accept(server_ssl);
1955 alarm(0);
1956
1957 if (rc <= 0)
1958   {
1959   tls_error(US"SSL_accept", NULL, sigalrm_seen ? US"timed out" : NULL);
1960   if (ERR_get_error() == 0)
1961     log_write(0, LOG_MAIN,
1962         "TLS client disconnected cleanly (rejected our certificate?)");
1963   return FAIL;
1964   }
1965
1966 DEBUG(D_tls) debug_printf("SSL_accept was successful\n");
1967
1968 /* TLS has been set up. Adjust the input functions to read via TLS,
1969 and initialize things. */
1970
1971 peer_cert(server_ssl, &tls_in, peerdn, sizeof(peerdn));
1972
1973 construct_cipher_name(server_ssl, cipherbuf, sizeof(cipherbuf), &tls_in.bits);
1974 tls_in.cipher = cipherbuf;
1975
1976 DEBUG(D_tls)
1977   {
1978   uschar buf[2048];
1979   if (SSL_get_shared_ciphers(server_ssl, CS buf, sizeof(buf)) != NULL)
1980     debug_printf("Shared ciphers: %s\n", buf);
1981   }
1982
1983 /* Record the certificate we presented */
1984   {
1985   X509 * crt = SSL_get_certificate(server_ssl);
1986   tls_in.ourcert = crt ? X509_dup(crt) : NULL;
1987   }
1988
1989 /* Only used by the server-side tls (tls_in), including tls_getc.
1990    Client-side (tls_out) reads (seem to?) go via
1991    smtp_read_response()/ip_recv().
1992    Hence no need to duplicate for _in and _out.
1993  */
1994 ssl_xfer_buffer = store_malloc(ssl_xfer_buffer_size);
1995 ssl_xfer_buffer_lwm = ssl_xfer_buffer_hwm = 0;
1996 ssl_xfer_eof = ssl_xfer_error = 0;
1997
1998 receive_getc = tls_getc;
1999 receive_get_cache = tls_get_cache;
2000 receive_ungetc = tls_ungetc;
2001 receive_feof = tls_feof;
2002 receive_ferror = tls_ferror;
2003 receive_smtp_buffered = tls_smtp_buffered;
2004
2005 tls_in.active = fileno(smtp_out);
2006 return OK;
2007 }
2008
2009
2010
2011
2012 static int
2013 tls_client_basic_ctx_init(SSL_CTX * ctx,
2014     host_item * host, smtp_transport_options_block * ob, tls_ext_ctx_cb * cbinfo
2015                           )
2016 {
2017 int rc;
2018 /* stick to the old behaviour for compatibility if tls_verify_certificates is
2019    set but both tls_verify_hosts and tls_try_verify_hosts is not set. Check only
2020    the specified host patterns if one of them is defined */
2021
2022 if (  (  !ob->tls_verify_hosts
2023       && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
2024       )
2025    || (verify_check_given_host(&ob->tls_verify_hosts, host) == OK)
2026    )
2027   client_verify_optional = FALSE;
2028 else if (verify_check_given_host(&ob->tls_try_verify_hosts, host) == OK)
2029   client_verify_optional = TRUE;
2030 else
2031   return OK;
2032
2033 if ((rc = setup_certs(ctx, ob->tls_verify_certificates,
2034       ob->tls_crl, host, client_verify_optional, verify_callback_client)) != OK)
2035   return rc;
2036
2037 if (verify_check_given_host(&ob->tls_verify_cert_hostnames, host) == OK)
2038   {
2039   cbinfo->verify_cert_hostnames =
2040 #ifdef SUPPORT_I18N
2041     string_domain_utf8_to_alabel(host->name, NULL);
2042 #else
2043     host->name;
2044 #endif
2045   DEBUG(D_tls) debug_printf("Cert hostname to check: \"%s\"\n",
2046                     cbinfo->verify_cert_hostnames);
2047   }
2048 return OK;
2049 }
2050
2051
2052 #ifdef EXPERIMENTAL_DANE
2053 static int
2054 dane_tlsa_load(SSL * ssl, host_item * host, dns_answer * dnsa)
2055 {
2056 dns_record * rr;
2057 dns_scan dnss;
2058 const char * hostnames[2] = { CS host->name, NULL };
2059 int found = 0;
2060
2061 if (DANESSL_init(ssl, NULL, hostnames) != 1)
2062   return tls_error(US"hostnames load", host, NULL);
2063
2064 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
2065      rr;
2066      rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
2067     ) if (rr->type == T_TLSA)
2068   {
2069   uschar * p = rr->data;
2070   uint8_t usage, selector, mtype;
2071   const char * mdname;
2072
2073   usage = *p++;
2074
2075   /* Only DANE-TA(2) and DANE-EE(3) are supported */
2076   if (usage != 2 && usage != 3) continue;
2077
2078   selector = *p++;
2079   mtype = *p++;
2080
2081   switch (mtype)
2082     {
2083     default: continue;  /* Only match-types 0, 1, 2 are supported */
2084     case 0:  mdname = NULL; break;
2085     case 1:  mdname = "sha256"; break;
2086     case 2:  mdname = "sha512"; break;
2087     }
2088
2089   found++;
2090   switch (DANESSL_add_tlsa(ssl, usage, selector, mdname, p, rr->size - 3))
2091     {
2092     default:
2093       return tls_error(US"tlsa load", host, NULL);
2094     case 0:     /* action not taken */
2095     case 1:     break;
2096     }
2097
2098   tls_out.tlsa_usage |= 1<<usage;
2099   }
2100
2101 if (found)
2102   return OK;
2103
2104 log_write(0, LOG_MAIN, "DANE error: No usable TLSA records");
2105 return DEFER;
2106 }
2107 #endif  /*EXPERIMENTAL_DANE*/
2108
2109
2110
2111 /*************************************************
2112 *    Start a TLS session in a client             *
2113 *************************************************/
2114
2115 /* Called from the smtp transport after STARTTLS has been accepted.
2116
2117 Argument:
2118   fd               the fd of the connection
2119   host             connected host (for messages)
2120   addr             the first address
2121   tb               transport (always smtp)
2122   tlsa_dnsa        tlsa lookup, if DANE, else null
2123
2124 Returns:           OK on success
2125                    FAIL otherwise - note that tls_error() will not give DEFER
2126                      because this is not a server
2127 */
2128
2129 int
2130 tls_client_start(int fd, host_item *host, address_item *addr,
2131   transport_instance *tb
2132 #ifdef EXPERIMENTAL_DANE
2133   , dns_answer * tlsa_dnsa
2134 #endif
2135   )
2136 {
2137 smtp_transport_options_block * ob =
2138   (smtp_transport_options_block *)tb->options_block;
2139 static uschar peerdn[256];
2140 uschar * expciphers;
2141 int rc;
2142 static uschar cipherbuf[256];
2143
2144 #ifndef DISABLE_OCSP
2145 BOOL request_ocsp = FALSE;
2146 BOOL require_ocsp = FALSE;
2147 #endif
2148
2149 #ifdef EXPERIMENTAL_DANE
2150 tls_out.tlsa_usage = 0;
2151 #endif
2152
2153 #ifndef DISABLE_OCSP
2154   {
2155 # ifdef EXPERIMENTAL_DANE
2156   if (  tlsa_dnsa
2157      && ob->hosts_request_ocsp[0] == '*'
2158      && ob->hosts_request_ocsp[1] == '\0'
2159      )
2160     {
2161     /* Unchanged from default.  Use a safer one under DANE */
2162     request_ocsp = TRUE;
2163     ob->hosts_request_ocsp = US"${if or { {= {0}{$tls_out_tlsa_usage}} "
2164                                       "   {= {4}{$tls_out_tlsa_usage}} } "
2165                                  " {*}{}}";
2166     }
2167 # endif
2168
2169   if ((require_ocsp =
2170         verify_check_given_host(&ob->hosts_require_ocsp, host) == OK))
2171     request_ocsp = TRUE;
2172   else
2173 # ifdef EXPERIMENTAL_DANE
2174     if (!request_ocsp)
2175 # endif
2176       request_ocsp =
2177         verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
2178   }
2179 #endif
2180
2181 rc = tls_init(&client_ctx, host, NULL,
2182     ob->tls_certificate, ob->tls_privatekey,
2183 #ifndef DISABLE_OCSP
2184     (void *)(long)request_ocsp,
2185 #endif
2186     addr, &client_static_cbinfo);
2187 if (rc != OK) return rc;
2188
2189 tls_out.certificate_verified = FALSE;
2190 client_verify_callback_called = FALSE;
2191
2192 if (!expand_check(ob->tls_require_ciphers, US"tls_require_ciphers",
2193     &expciphers))
2194   return FAIL;
2195
2196 /* In OpenSSL, cipher components are separated by hyphens. In GnuTLS, they
2197 are separated by underscores. So that I can use either form in my tests, and
2198 also for general convenience, we turn underscores into hyphens here. */
2199
2200 if (expciphers != NULL)
2201   {
2202   uschar *s = expciphers;
2203   while (*s != 0) { if (*s == '_') *s = '-'; s++; }
2204   DEBUG(D_tls) debug_printf("required ciphers: %s\n", expciphers);
2205   if (!SSL_CTX_set_cipher_list(client_ctx, CS expciphers))
2206     return tls_error(US"SSL_CTX_set_cipher_list", host, NULL);
2207   }
2208
2209 #ifdef EXPERIMENTAL_DANE
2210 if (tlsa_dnsa)
2211   {
2212   SSL_CTX_set_verify(client_ctx,
2213     SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
2214     verify_callback_client_dane);
2215
2216   if (!DANESSL_library_init())
2217     return tls_error(US"library init", host, NULL);
2218   if (DANESSL_CTX_init(client_ctx) <= 0)
2219     return tls_error(US"context init", host, NULL);
2220   }
2221 else
2222
2223 #endif
2224
2225   if ((rc = tls_client_basic_ctx_init(client_ctx, host, ob, client_static_cbinfo))
2226       != OK)
2227     return rc;
2228
2229 if ((client_ssl = SSL_new(client_ctx)) == NULL)
2230   return tls_error(US"SSL_new", host, NULL);
2231 SSL_set_session_id_context(client_ssl, sid_ctx, Ustrlen(sid_ctx));
2232 SSL_set_fd(client_ssl, fd);
2233 SSL_set_connect_state(client_ssl);
2234
2235 if (ob->tls_sni)
2236   {
2237   if (!expand_check(ob->tls_sni, US"tls_sni", &tls_out.sni))
2238     return FAIL;
2239   if (tls_out.sni == NULL)
2240     {
2241     DEBUG(D_tls) debug_printf("Setting TLS SNI forced to fail, not sending\n");
2242     }
2243   else if (!Ustrlen(tls_out.sni))
2244     tls_out.sni = NULL;
2245   else
2246     {
2247 #ifdef EXIM_HAVE_OPENSSL_TLSEXT
2248     DEBUG(D_tls) debug_printf("Setting TLS SNI \"%s\"\n", tls_out.sni);
2249     SSL_set_tlsext_host_name(client_ssl, tls_out.sni);
2250 #else
2251     log_write(0, LOG_MAIN, "SNI unusable with this OpenSSL library version; ignoring \"%s\"\n",
2252           tls_out.sni);
2253 #endif
2254     }
2255   }
2256
2257 #ifdef EXPERIMENTAL_DANE
2258 if (tlsa_dnsa)
2259   if ((rc = dane_tlsa_load(client_ssl, host, tlsa_dnsa)) != OK)
2260     return rc;
2261 #endif
2262
2263 #ifndef DISABLE_OCSP
2264 /* Request certificate status at connection-time.  If the server
2265 does OCSP stapling we will get the callback (set in tls_init()) */
2266 # ifdef EXPERIMENTAL_DANE
2267 if (request_ocsp)
2268   {
2269   const uschar * s;
2270   if (  ((s = ob->hosts_require_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
2271      || ((s = ob->hosts_request_ocsp) && Ustrstr(s, US"tls_out_tlsa_usage"))
2272      )
2273     {   /* Re-eval now $tls_out_tlsa_usage is populated.  If
2274         this means we avoid the OCSP request, we wasted the setup
2275         cost in tls_init(). */
2276     require_ocsp = verify_check_given_host(&ob->hosts_require_ocsp, host) == OK;
2277     request_ocsp = require_ocsp
2278       || verify_check_given_host(&ob->hosts_request_ocsp, host) == OK;
2279     }
2280   }
2281 # endif
2282
2283 if (request_ocsp)
2284   {
2285   SSL_set_tlsext_status_type(client_ssl, TLSEXT_STATUSTYPE_ocsp);
2286   client_static_cbinfo->u_ocsp.client.verify_required = require_ocsp;
2287   tls_out.ocsp = OCSP_NOT_RESP;
2288   }
2289 #endif
2290
2291 #ifndef DISABLE_EVENT
2292 client_static_cbinfo->event_action = tb->event_action;
2293 #endif
2294
2295 /* There doesn't seem to be a built-in timeout on connection. */
2296
2297 DEBUG(D_tls) debug_printf("Calling SSL_connect\n");
2298 sigalrm_seen = FALSE;
2299 alarm(ob->command_timeout);
2300 rc = SSL_connect(client_ssl);
2301 alarm(0);
2302
2303 #ifdef EXPERIMENTAL_DANE
2304 if (tlsa_dnsa)
2305   DANESSL_cleanup(client_ssl);
2306 #endif
2307
2308 if (rc <= 0)
2309   return tls_error(US"SSL_connect", host, sigalrm_seen ? US"timed out" : NULL);
2310
2311 DEBUG(D_tls) debug_printf("SSL_connect succeeded\n");
2312
2313 peer_cert(client_ssl, &tls_out, peerdn, sizeof(peerdn));
2314
2315 construct_cipher_name(client_ssl, cipherbuf, sizeof(cipherbuf), &tls_out.bits);
2316 tls_out.cipher = cipherbuf;
2317
2318 /* Record the certificate we presented */
2319   {
2320   X509 * crt = SSL_get_certificate(client_ssl);
2321   tls_out.ourcert = crt ? X509_dup(crt) : NULL;
2322   }
2323
2324 tls_out.active = fd;
2325 return OK;
2326 }
2327
2328
2329
2330
2331
2332 /*************************************************
2333 *            TLS version of getc                 *
2334 *************************************************/
2335
2336 /* This gets the next byte from the TLS input buffer. If the buffer is empty,
2337 it refills the buffer via the SSL reading function.
2338
2339 Arguments:  none
2340 Returns:    the next character or EOF
2341
2342 Only used by the server-side TLS.
2343 */
2344
2345 int
2346 tls_getc(void)
2347 {
2348 if (ssl_xfer_buffer_lwm >= ssl_xfer_buffer_hwm)
2349   {
2350   int error;
2351   int inbytes;
2352
2353   DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", server_ssl,
2354     ssl_xfer_buffer, ssl_xfer_buffer_size);
2355
2356   if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
2357   inbytes = SSL_read(server_ssl, CS ssl_xfer_buffer, ssl_xfer_buffer_size);
2358   error = SSL_get_error(server_ssl, inbytes);
2359   alarm(0);
2360
2361   /* SSL_ERROR_ZERO_RETURN appears to mean that the SSL session has been
2362   closed down, not that the socket itself has been closed down. Revert to
2363   non-SSL handling. */
2364
2365   if (error == SSL_ERROR_ZERO_RETURN)
2366     {
2367     DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2368
2369     receive_getc = smtp_getc;
2370     receive_get_cache = smtp_get_cache;
2371     receive_ungetc = smtp_ungetc;
2372     receive_feof = smtp_feof;
2373     receive_ferror = smtp_ferror;
2374     receive_smtp_buffered = smtp_buffered;
2375
2376     SSL_free(server_ssl);
2377     server_ssl = NULL;
2378     tls_in.active = -1;
2379     tls_in.bits = 0;
2380     tls_in.cipher = NULL;
2381     tls_in.peerdn = NULL;
2382     tls_in.sni = NULL;
2383
2384     return smtp_getc();
2385     }
2386
2387   /* Handle genuine errors */
2388
2389   else if (error == SSL_ERROR_SSL)
2390     {
2391     ERR_error_string(ERR_get_error(), ssl_errstring);
2392     log_write(0, LOG_MAIN, "TLS error (SSL_read): %s", ssl_errstring);
2393     ssl_xfer_error = 1;
2394     return EOF;
2395     }
2396
2397   else if (error != SSL_ERROR_NONE)
2398     {
2399     DEBUG(D_tls) debug_printf("Got SSL error %d\n", error);
2400     ssl_xfer_error = 1;
2401     return EOF;
2402     }
2403
2404 #ifndef DISABLE_DKIM
2405   dkim_exim_verify_feed(ssl_xfer_buffer, inbytes);
2406 #endif
2407   ssl_xfer_buffer_hwm = inbytes;
2408   ssl_xfer_buffer_lwm = 0;
2409   }
2410
2411 /* Something in the buffer; return next uschar */
2412
2413 return ssl_xfer_buffer[ssl_xfer_buffer_lwm++];
2414 }
2415
2416 void
2417 tls_get_cache()
2418 {
2419 #ifndef DISABLE_DKIM
2420 int n = ssl_xfer_buffer_hwm - ssl_xfer_buffer_lwm;
2421 if (n > 0)
2422   dkim_exim_verify_feed(ssl_xfer_buffer+ssl_xfer_buffer_lwm, n);
2423 #endif
2424 }
2425
2426
2427
2428 /*************************************************
2429 *          Read bytes from TLS channel           *
2430 *************************************************/
2431
2432 /*
2433 Arguments:
2434   buff      buffer of data
2435   len       size of buffer
2436
2437 Returns:    the number of bytes read
2438             -1 after a failed read
2439
2440 Only used by the client-side TLS.
2441 */
2442
2443 int
2444 tls_read(BOOL is_server, uschar *buff, size_t len)
2445 {
2446 SSL *ssl = is_server ? server_ssl : client_ssl;
2447 int inbytes;
2448 int error;
2449
2450 DEBUG(D_tls) debug_printf("Calling SSL_read(%p, %p, %u)\n", ssl,
2451   buff, (unsigned int)len);
2452
2453 inbytes = SSL_read(ssl, CS buff, len);
2454 error = SSL_get_error(ssl, inbytes);
2455
2456 if (error == SSL_ERROR_ZERO_RETURN)
2457   {
2458   DEBUG(D_tls) debug_printf("Got SSL_ERROR_ZERO_RETURN\n");
2459   return -1;
2460   }
2461 else if (error != SSL_ERROR_NONE)
2462   {
2463   return -1;
2464   }
2465
2466 return inbytes;
2467 }
2468
2469
2470
2471
2472
2473 /*************************************************
2474 *         Write bytes down TLS channel           *
2475 *************************************************/
2476
2477 /*
2478 Arguments:
2479   is_server channel specifier
2480   buff      buffer of data
2481   len       number of bytes
2482
2483 Returns:    the number of bytes after a successful write,
2484             -1 after a failed write
2485
2486 Used by both server-side and client-side TLS.
2487 */
2488
2489 int
2490 tls_write(BOOL is_server, const uschar *buff, size_t len)
2491 {
2492 int outbytes;
2493 int error;
2494 int left = len;
2495 SSL *ssl = is_server ? server_ssl : client_ssl;
2496
2497 DEBUG(D_tls) debug_printf("tls_do_write(%p, %d)\n", buff, left);
2498 while (left > 0)
2499   {
2500   DEBUG(D_tls) debug_printf("SSL_write(SSL, %p, %d)\n", buff, left);
2501   outbytes = SSL_write(ssl, CS buff, left);
2502   error = SSL_get_error(ssl, outbytes);
2503   DEBUG(D_tls) debug_printf("outbytes=%d error=%d\n", outbytes, error);
2504   switch (error)
2505     {
2506     case SSL_ERROR_SSL:
2507       ERR_error_string(ERR_get_error(), ssl_errstring);
2508       log_write(0, LOG_MAIN, "TLS error (SSL_write): %s", ssl_errstring);
2509       return -1;
2510
2511     case SSL_ERROR_NONE:
2512       left -= outbytes;
2513       buff += outbytes;
2514       break;
2515
2516     case SSL_ERROR_ZERO_RETURN:
2517       log_write(0, LOG_MAIN, "SSL channel closed on write");
2518       return -1;
2519
2520     case SSL_ERROR_SYSCALL:
2521       log_write(0, LOG_MAIN, "SSL_write: (from %s) syscall: %s",
2522         sender_fullhost ? sender_fullhost : US"<unknown>",
2523         strerror(errno));
2524       return -1;
2525
2526     default:
2527       log_write(0, LOG_MAIN, "SSL_write error %d", error);
2528       return -1;
2529     }
2530   }
2531 return len;
2532 }
2533
2534
2535
2536 /*************************************************
2537 *         Close down a TLS session               *
2538 *************************************************/
2539
2540 /* This is also called from within a delivery subprocess forked from the
2541 daemon, to shut down the TLS library, without actually doing a shutdown (which
2542 would tamper with the SSL session in the parent process).
2543
2544 Arguments:   TRUE if SSL_shutdown is to be called
2545 Returns:     nothing
2546
2547 Used by both server-side and client-side TLS.
2548 */
2549
2550 void
2551 tls_close(BOOL is_server, BOOL shutdown)
2552 {
2553 SSL **sslp = is_server ? &server_ssl : &client_ssl;
2554 int *fdp = is_server ? &tls_in.active : &tls_out.active;
2555
2556 if (*fdp < 0) return;  /* TLS was not active */
2557
2558 if (shutdown)
2559   {
2560   DEBUG(D_tls) debug_printf("tls_close(): shutting down SSL\n");
2561   SSL_shutdown(*sslp);
2562   }
2563
2564 SSL_free(*sslp);
2565 *sslp = NULL;
2566
2567 *fdp = -1;
2568 }
2569
2570
2571
2572
2573 /*************************************************
2574 *  Let tls_require_ciphers be checked at startup *
2575 *************************************************/
2576
2577 /* The tls_require_ciphers option, if set, must be something which the
2578 library can parse.
2579
2580 Returns:     NULL on success, or error message
2581 */
2582
2583 uschar *
2584 tls_validate_require_cipher(void)
2585 {
2586 SSL_CTX *ctx;
2587 uschar *s, *expciphers, *err;
2588
2589 /* this duplicates from tls_init(), we need a better "init just global
2590 state, for no specific purpose" singleton function of our own */
2591
2592 SSL_load_error_strings();
2593 OpenSSL_add_ssl_algorithms();
2594 #if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_SHA256)
2595 /* SHA256 is becoming ever more popular. This makes sure it gets added to the
2596 list of available digests. */
2597 EVP_add_digest(EVP_sha256());
2598 #endif
2599
2600 if (!(tls_require_ciphers && *tls_require_ciphers))
2601   return NULL;
2602
2603 if (!expand_check(tls_require_ciphers, US"tls_require_ciphers", &expciphers))
2604   return US"failed to expand tls_require_ciphers";
2605
2606 if (!(expciphers && *expciphers))
2607   return NULL;
2608
2609 /* normalisation ripped from above */
2610 s = expciphers;
2611 while (*s != 0) { if (*s == '_') *s = '-'; s++; }
2612
2613 err = NULL;
2614
2615 ctx = SSL_CTX_new(SSLv23_server_method());
2616 if (!ctx)
2617   {
2618   ERR_error_string(ERR_get_error(), ssl_errstring);
2619   return string_sprintf("SSL_CTX_new() failed: %s", ssl_errstring);
2620   }
2621
2622 DEBUG(D_tls)
2623   debug_printf("tls_require_ciphers expands to \"%s\"\n", expciphers);
2624
2625 if (!SSL_CTX_set_cipher_list(ctx, CS expciphers))
2626   {
2627   ERR_error_string(ERR_get_error(), ssl_errstring);
2628   err = string_sprintf("SSL_CTX_set_cipher_list(%s) failed", expciphers);
2629   }
2630
2631 SSL_CTX_free(ctx);
2632
2633 return err;
2634 }
2635
2636
2637
2638
2639 /*************************************************
2640 *         Report the library versions.           *
2641 *************************************************/
2642
2643 /* There have historically been some issues with binary compatibility in
2644 OpenSSL libraries; if Exim (like many other applications) is built against
2645 one version of OpenSSL but the run-time linker picks up another version,
2646 it can result in serious failures, including crashing with a SIGSEGV.  So
2647 report the version found by the compiler and the run-time version.
2648
2649 Note: some OS vendors backport security fixes without changing the version
2650 number/string, and the version date remains unchanged.  The _build_ date
2651 will change, so we can more usefully assist with version diagnosis by also
2652 reporting the build date.
2653
2654 Arguments:   a FILE* to print the results to
2655 Returns:     nothing
2656 */
2657
2658 void
2659 tls_version_report(FILE *f)
2660 {
2661 fprintf(f, "Library version: OpenSSL: Compile: %s\n"
2662            "                          Runtime: %s\n"
2663            "                                 : %s\n",
2664            OPENSSL_VERSION_TEXT,
2665            SSLeay_version(SSLEAY_VERSION),
2666            SSLeay_version(SSLEAY_BUILT_ON));
2667 /* third line is 38 characters for the %s and the line is 73 chars long;
2668 the OpenSSL output includes a "built on: " prefix already. */
2669 }
2670
2671
2672
2673
2674 /*************************************************
2675 *            Random number generation            *
2676 *************************************************/
2677
2678 /* Pseudo-random number generation.  The result is not expected to be
2679 cryptographically strong but not so weak that someone will shoot themselves
2680 in the foot using it as a nonce in input in some email header scheme or
2681 whatever weirdness they'll twist this into.  The result should handle fork()
2682 and avoid repeating sequences.  OpenSSL handles that for us.
2683
2684 Arguments:
2685   max       range maximum
2686 Returns     a random number in range [0, max-1]
2687 */
2688
2689 int
2690 vaguely_random_number(int max)
2691 {
2692 unsigned int r;
2693 int i, needed_len;
2694 static pid_t pidlast = 0;
2695 pid_t pidnow;
2696 uschar *p;
2697 uschar smallbuf[sizeof(r)];
2698
2699 if (max <= 1)
2700   return 0;
2701
2702 pidnow = getpid();
2703 if (pidnow != pidlast)
2704   {
2705   /* Although OpenSSL documents that "OpenSSL makes sure that the PRNG state
2706   is unique for each thread", this doesn't apparently apply across processes,
2707   so our own warning from vaguely_random_number_fallback() applies here too.
2708   Fix per PostgreSQL. */
2709   if (pidlast != 0)
2710     RAND_cleanup();
2711   pidlast = pidnow;
2712   }
2713
2714 /* OpenSSL auto-seeds from /dev/random, etc, but this a double-check. */
2715 if (!RAND_status())
2716   {
2717   randstuff r;
2718   gettimeofday(&r.tv, NULL);
2719   r.p = getpid();
2720
2721   RAND_seed((uschar *)(&r), sizeof(r));
2722   }
2723 /* We're after pseudo-random, not random; if we still don't have enough data
2724 in the internal PRNG then our options are limited.  We could sleep and hope
2725 for entropy to come along (prayer technique) but if the system is so depleted
2726 in the first place then something is likely to just keep taking it.  Instead,
2727 we'll just take whatever little bit of pseudo-random we can still manage to
2728 get. */
2729
2730 needed_len = sizeof(r);
2731 /* Don't take 8 times more entropy than needed if int is 8 octets and we were
2732 asked for a number less than 10. */
2733 for (r = max, i = 0; r; ++i)
2734   r >>= 1;
2735 i = (i + 7) / 8;
2736 if (i < needed_len)
2737   needed_len = i;
2738
2739 #ifdef EXIM_HAVE_RAND_PSEUDO
2740 /* We do not care if crypto-strong */
2741 i = RAND_pseudo_bytes(smallbuf, needed_len);
2742 #else
2743 i = RAND_bytes(smallbuf, needed_len);
2744 #endif
2745
2746 if (i < 0)
2747   {
2748   DEBUG(D_all)
2749     debug_printf("OpenSSL RAND_pseudo_bytes() not supported by RAND method, using fallback.\n");
2750   return vaguely_random_number_fallback(max);
2751   }
2752
2753 r = 0;
2754 for (p = smallbuf; needed_len; --needed_len, ++p)
2755   {
2756   r *= 256;
2757   r += *p;
2758   }
2759
2760 /* We don't particularly care about weighted results; if someone wants
2761 smooth distribution and cares enough then they should submit a patch then. */
2762 return r % max;
2763 }
2764
2765
2766
2767
2768 /*************************************************
2769 *        OpenSSL option parse                    *
2770 *************************************************/
2771
2772 /* Parse one option for tls_openssl_options_parse below
2773
2774 Arguments:
2775   name    one option name
2776   value   place to store a value for it
2777 Returns   success or failure in parsing
2778 */
2779
2780 struct exim_openssl_option {
2781   uschar *name;
2782   long    value;
2783 };
2784 /* We could use a macro to expand, but we need the ifdef and not all the
2785 options document which version they were introduced in.  Policylet: include
2786 all options unless explicitly for DTLS, let the administrator choose which
2787 to apply.
2788
2789 This list is current as of:
2790   ==>  1.0.1b  <==
2791 Plus SSL_OP_SAFARI_ECDHE_ECDSA_BUG from 2013-June patch/discussion on openssl-dev
2792 */
2793 static struct exim_openssl_option exim_openssl_options[] = {
2794 /* KEEP SORTED ALPHABETICALLY! */
2795 #ifdef SSL_OP_ALL
2796   { US"all", SSL_OP_ALL },
2797 #endif
2798 #ifdef SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
2799   { US"allow_unsafe_legacy_renegotiation", SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION },
2800 #endif
2801 #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
2802   { US"cipher_server_preference", SSL_OP_CIPHER_SERVER_PREFERENCE },
2803 #endif
2804 #ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
2805   { US"dont_insert_empty_fragments", SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS },
2806 #endif
2807 #ifdef SSL_OP_EPHEMERAL_RSA
2808   { US"ephemeral_rsa", SSL_OP_EPHEMERAL_RSA },
2809 #endif
2810 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
2811   { US"legacy_server_connect", SSL_OP_LEGACY_SERVER_CONNECT },
2812 #endif
2813 #ifdef SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER
2814   { US"microsoft_big_sslv3_buffer", SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER },
2815 #endif
2816 #ifdef SSL_OP_MICROSOFT_SESS_ID_BUG
2817   { US"microsoft_sess_id_bug", SSL_OP_MICROSOFT_SESS_ID_BUG },
2818 #endif
2819 #ifdef SSL_OP_MSIE_SSLV2_RSA_PADDING
2820   { US"msie_sslv2_rsa_padding", SSL_OP_MSIE_SSLV2_RSA_PADDING },
2821 #endif
2822 #ifdef SSL_OP_NETSCAPE_CHALLENGE_BUG
2823   { US"netscape_challenge_bug", SSL_OP_NETSCAPE_CHALLENGE_BUG },
2824 #endif
2825 #ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
2826   { US"netscape_reuse_cipher_change_bug", SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG },
2827 #endif
2828 #ifdef SSL_OP_NO_COMPRESSION
2829   { US"no_compression", SSL_OP_NO_COMPRESSION },
2830 #endif
2831 #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
2832   { US"no_session_resumption_on_renegotiation", SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION },
2833 #endif
2834 #ifdef SSL_OP_NO_SSLv2
2835   { US"no_sslv2", SSL_OP_NO_SSLv2 },
2836 #endif
2837 #ifdef SSL_OP_NO_SSLv3
2838   { US"no_sslv3", SSL_OP_NO_SSLv3 },
2839 #endif
2840 #ifdef SSL_OP_NO_TICKET
2841   { US"no_ticket", SSL_OP_NO_TICKET },
2842 #endif
2843 #ifdef SSL_OP_NO_TLSv1
2844   { US"no_tlsv1", SSL_OP_NO_TLSv1 },
2845 #endif
2846 #ifdef SSL_OP_NO_TLSv1_1
2847 #if SSL_OP_NO_TLSv1_1 == 0x00000400L
2848   /* Error in chosen value in 1.0.1a; see first item in CHANGES for 1.0.1b */
2849 #warning OpenSSL 1.0.1a uses a bad value for SSL_OP_NO_TLSv1_1, ignoring
2850 #else
2851   { US"no_tlsv1_1", SSL_OP_NO_TLSv1_1 },
2852 #endif
2853 #endif
2854 #ifdef SSL_OP_NO_TLSv1_2
2855   { US"no_tlsv1_2", SSL_OP_NO_TLSv1_2 },
2856 #endif
2857 #ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG
2858   { US"safari_ecdhe_ecdsa_bug", SSL_OP_SAFARI_ECDHE_ECDSA_BUG },
2859 #endif
2860 #ifdef SSL_OP_SINGLE_DH_USE
2861   { US"single_dh_use", SSL_OP_SINGLE_DH_USE },
2862 #endif
2863 #ifdef SSL_OP_SINGLE_ECDH_USE
2864   { US"single_ecdh_use", SSL_OP_SINGLE_ECDH_USE },
2865 #endif
2866 #ifdef SSL_OP_SSLEAY_080_CLIENT_DH_BUG
2867   { US"ssleay_080_client_dh_bug", SSL_OP_SSLEAY_080_CLIENT_DH_BUG },
2868 #endif
2869 #ifdef SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
2870   { US"sslref2_reuse_cert_type_bug", SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG },
2871 #endif
2872 #ifdef SSL_OP_TLS_BLOCK_PADDING_BUG
2873   { US"tls_block_padding_bug", SSL_OP_TLS_BLOCK_PADDING_BUG },
2874 #endif
2875 #ifdef SSL_OP_TLS_D5_BUG
2876   { US"tls_d5_bug", SSL_OP_TLS_D5_BUG },
2877 #endif
2878 #ifdef SSL_OP_TLS_ROLLBACK_BUG
2879   { US"tls_rollback_bug", SSL_OP_TLS_ROLLBACK_BUG },
2880 #endif
2881 };
2882 static int exim_openssl_options_size =
2883   sizeof(exim_openssl_options)/sizeof(struct exim_openssl_option);
2884
2885
2886 static BOOL
2887 tls_openssl_one_option_parse(uschar *name, long *value)
2888 {
2889 int first = 0;
2890 int last = exim_openssl_options_size;
2891 while (last > first)
2892   {
2893   int middle = (first + last)/2;
2894   int c = Ustrcmp(name, exim_openssl_options[middle].name);
2895   if (c == 0)
2896     {
2897     *value = exim_openssl_options[middle].value;
2898     return TRUE;
2899     }
2900   else if (c > 0)
2901     first = middle + 1;
2902   else
2903     last = middle;
2904   }
2905 return FALSE;
2906 }
2907
2908
2909
2910
2911 /*************************************************
2912 *        OpenSSL option parsing logic            *
2913 *************************************************/
2914
2915 /* OpenSSL has a number of compatibility options which an administrator might
2916 reasonably wish to set.  Interpret a list similarly to decode_bits(), so that
2917 we look like log_selector.
2918
2919 Arguments:
2920   option_spec  the administrator-supplied string of options
2921   results      ptr to long storage for the options bitmap
2922 Returns        success or failure
2923 */
2924
2925 BOOL
2926 tls_openssl_options_parse(uschar *option_spec, long *results)
2927 {
2928 long result, item;
2929 uschar *s, *end;
2930 uschar keep_c;
2931 BOOL adding, item_parsed;
2932
2933 result = 0L;
2934 /* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
2935  * from default because it increases BEAST susceptibility. */
2936 #ifdef SSL_OP_NO_SSLv2
2937 result |= SSL_OP_NO_SSLv2;
2938 #endif
2939 #ifdef SSL_OP_SINGLE_DH_USE
2940 result |= SSL_OP_SINGLE_DH_USE;
2941 #endif
2942
2943 if (option_spec == NULL)
2944   {
2945   *results = result;
2946   return TRUE;
2947   }
2948
2949 for (s=option_spec; *s != '\0'; /**/)
2950   {
2951   while (isspace(*s)) ++s;
2952   if (*s == '\0')
2953     break;
2954   if (*s != '+' && *s != '-')
2955     {
2956     DEBUG(D_tls) debug_printf("malformed openssl option setting: "
2957         "+ or - expected but found \"%s\"\n", s);
2958     return FALSE;
2959     }
2960   adding = *s++ == '+';
2961   for (end = s; (*end != '\0') && !isspace(*end); ++end) /**/ ;
2962   keep_c = *end;
2963   *end = '\0';
2964   item_parsed = tls_openssl_one_option_parse(s, &item);
2965   *end = keep_c;
2966   if (!item_parsed)
2967     {
2968     DEBUG(D_tls) debug_printf("openssl option setting unrecognised: \"%s\"\n", s);
2969     return FALSE;
2970     }
2971   DEBUG(D_tls) debug_printf("openssl option, %s from %lx: %lx (%s)\n",
2972       adding ? "adding" : "removing", result, item, s);
2973   if (adding)
2974     result |= item;
2975   else
2976     result &= ~item;
2977   s = end;
2978   }
2979
2980 *results = result;
2981 return TRUE;
2982 }
2983
2984 /* vi: aw ai sw=2
2985 */
2986 /* End of tls-openssl.c */